Cyber Threat Hunter

NinjaOne•Austin, TX

14h•Hybrid

About The Position

We are looking for a Threat Hunter to join our Cyber Threat Intelligence function and run proactive, hypothesis-driven hunts across our environment. This is a dedicated hunting role at the front of a detection pipeline: you will turn intelligence and adversary tradecraft into concrete hunts and turn what you find into detection packages that our tooling team operationalizes and our SOC consumes as tuned, documented alerts. You will sit at the intersection of threat intelligence, detection engineering, and offensive validation. Working from CTI and from our red teamer's findings, you will hunt for activity that never trips an existing alert, novel techniques, living-off-the-land tradecraft, misconfiguration abuse, and long-dwell intrusions, and close those gaps by feeding durable detections and configuration fixes back into the organization. It is a role for a curious, methodical hunter who is energized by long-horizon investigation rather than the pace of the alert queue.

Requirements

5+ years in a security operations, detection engineering, CTI, or incident response role, with meaningful hands-on threat-hunting responsibility
Demonstrated experience running hypothesis-driven hunts, forming a hypothesis, testing it against telemetry, and driving it to a conclusion, not solely alert triage
Strong working knowledge of adversary tactics, techniques, and procedures, and practical fluency with the MITRE ATT&CK framework
Proficiency querying and pivoting across security telemetry at scale in a SIEM and/or EDR/XDR (e.g., KQL, SPL, or equivalent query languages)
Solid understanding of endpoint, identity, cloud, and network telemetry, and a sense of what normal and abnormal look like in each
Ability to turn a hunt finding into a detection recommendation, including logic, supporting context, and fidelity/signal-to-noise considerations
Understanding of the detection lifecycle and why signal-to-noise quality matters to a SOC
Clear written communication for documentation, detection packages, and SOP recommendations
Able to plan and sustain long-horizon hunt campaigns with limited day-to-day direction

Nice To Haves

Experience consuming red-team or purple-team output to drive and prioritize hunts
Scripting for automation and enrichment (Python preferred)
Familiarity with detection-as-code workflows and version-controlled detection content
Depth in cloud-native and SaaS telemetry (CloudTrail, Entra ID/Azure AD, SaaS audit logs)
Experience with a threat intelligence platform (TIP) and structured intel workflows
Exposure to an IR-capable or standing-response team environment
Relevant certifications, one or more (preferred, not required): GCTI, GCFA, GCDA, GCIA, or similar GIAC certifications
OSCP or comparable (for offensive-tradecraft awareness)
Cloud security certifications (AWS, Azure, or GCP), or equivalent

Responsibilities

Plan and run hypothesis-driven hunts (intel-led, TTP-led, and behavior-led) across endpoint, identity, cloud, and network telemetry
Consume CTI and red-team/purple-team findings to prioritize hunts against the adversary behaviors most relevant to us
Map hunts and findings to MITRE ATT&CK to track coverage and expose blind spots
Translate hunt findings into detection packages and recommendations, including detection logic, required context and enrichment, and draft SOP guidance, for the tooling team to operationalize
Partner with the red teamer on purple validation of configuration faults and security-posture gaps
Surface configuration faults and posture gaps discovered during hunts, and drive recommendations to close them
Document hypotheses, methods, and outcomes so hunting knowledge lives in reusable artifacts rather than in one person's head
Contribute threat context and hunt-derived intelligence during declared Sev 1 incidents, in an advisory (non-primary) capacity
Other duties as needed