Cyber Threat Hunter Lead

American Electric Power•Columbus, OH

About The Position

The Cyber Threat Hunter Lead leads proactive threat hunting across enterprise, cloud, identity, and operational technology environments to identify and disrupt advanced adversary activity. The role analyzes threat intelligence, adversary tactics, techniques, and procedures (TTPs), and emerging trends to assess risk and prioritize hunts. It conducts hypothesis-driven hunts using MITRE ATT&CK, the Cyber Kill Chain, and intelligence-driven methods, and leads investigations into advanced persistent threats, insider threats, ransomware, and targeted intrusions. The position serves as a senior technical advisor during incident response, providing threat analysis, scoping, forensic expertise, and remediation recommendations. It conducts advanced host, network, memory, and malware analysis, reverse engineers malware and attacker tools, and turns hunt findings into detection content and security improvements in collaboration with Detection Engineering and Security Operations. The role also identifies gaps in security visibility, telemetry, and controls; partners with external and internal stakeholders; develops hunting playbooks and standards; mentors junior staff; communicates technical findings and risks; and advances program effectiveness through automation, detection enhancement, adversary emulation, metrics, and continuous improvement.

Requirements

Bachelor's degree; OR an associate degree with 2 years of relevant system administration, help desk, or security experience (cyber or physical); OR a high school diploma/GED with 4 years of relevant IT system administration, help desk, or security experience (cyber or physical).
7 or more years of IT-related experience, OR 5 or more years of security-related experience; military or government work experience may count toward the security-related experience requirement.

Responsibilities

Lead proactive threat hunting across enterprise, cloud, identity, and operational technology environments.
Analyze cyber threat intelligence, adversary TTPs, and emerging threat trends to assess risk and prioritize hunting efforts.
Develop and execute hypothesis-driven hunts using MITRE ATT&CK, the Cyber Kill Chain, and intelligence-driven methodologies.
Lead complex investigations involving advanced persistent threats, insider threats, ransomware, and targeted intrusions.
Provide threat analysis, scoping, forensic expertise, and remediation recommendations during cyber incident response.
Conduct advanced host, network, memory, and malware analysis to uncover adversary behavior and indicators of compromise.
Reverse engineer malware and attacker tools to develop intelligence, improve detections, and support threat response.
Translate hunting findings into actionable detection content, use cases, and security improvements with Detection Engineering and Security Operations teams.
Identify gaps in visibility, telemetry, and security controls and recommend strategic improvements.
Partner with government agencies, intelligence-sharing organizations, industry peers, and internal stakeholders to strengthen threat awareness and defensive readiness.
Develop threat hunting playbooks, methodologies, and operational standards.
Mentor and coach junior threat hunters and analysts.
Communicate technical findings and cyber risks clearly to technical and non-technical audiences.
Use cybersecurity tools and advanced analytics to uncover stealthy or previously unidentified threats.
Improve hunting capabilities through automation, detection enhancement, adversary emulation, and lessons learned.
Establish and track threat hunting metrics to measure effectiveness, demonstrate value, and guide program improvements.
Maintain expert-level knowledge of emerging threat actors, attack techniques, vulnerabilities, and cybersecurity technologies.