Lead Threat Hunter

Allstate • McCullom Lake, IL

14d • $120,000 - $175,000

About The Position

Allstate is seeking a Lead Threat Hunter to lead hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. The role proactively identifies adversary tradecraft that evades existing detections, turns findings into durable detection logic, and works with Threat Intelligence, Detection Engineering, Incident Response, Exposure Management, and REM to reduce dwell time and enterprise exposure. The hunter uses frameworks including MITRE ATT&CK, the Pyramid of Pain, and the Diamond Model to drive measurable risk reduction.

The position also involves hunting across identity, cloud, and AI/LLM environments; developing analytics, automation, and custom tooling; supporting incident response, forensics, insider threat and fraud investigations; and mentoring junior hunters. The role communicates findings to technical peers and executive leadership and works autonomously within strategic priorities.

Allstate provides a technology setup including a laptop, monitors, headset, keyboard, and mouse. Employees eligible to work from home receive a monthly connectivity reimbursement. Home workers must have a dedicated private workspace, appropriate desk and seating, and reliable internet with minimum speeds of 50 MB download and 5 MB upload.

Requirements

• At least 7 years of experience in security operations, including at least 4 years dedicated to threat hunting.
• Deep experience hunting in large, complex enterprise environments.
• Demonstrable experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs.
• Hands-on experience with modern SIEM platforms such as Splunk, Sentinel, or Elastic and EDR/XDR platforms such as CrowdStrike, Defender, SentinelOne, or Tanium.
• Demonstrated experience using AI/LLM-assisted tooling to accelerate hunting, triage, and analytic development.
• Working knowledge of hunting in AI/LLM environments, MITRE ATLAS, the OWASP Top 10 for LLM Applications, and common AI-specific threats.
• Working knowledge of threat intelligence frameworks including the Diamond Model, Kill Chain, and Pyramid of Pain.
• Strong scripting and automation skills in Python, PowerShell, Go, and/or Bash.
• Deep understanding of common network and application protocols, including TCP/IP, DNS, TLS, HTTP, and SMTP.
• Experience with signature and analytic development, including CQL/KQL/SPL analytics, Sigma, YARA, and Snort/Suricata.
• Excellent analytical and problem-solving skills, a research mindset, and an interest in solving puzzles.
• Strong written and verbal communication skills, including the ability to produce executive-ready summaries of technical findings.
• Demonstrated leadership and mentoring capability.
• Motivation to learn and train in new technologies and techniques; self-starter.
• Demonstrated ownership of end-to-end hunting programs, including hypothesis generation, data-source evaluation, hunt execution, findings analysis, stakeholder communication, and outcome measurement.

Nice To Haves

• Proficiency in KQL/CQL/SPL and comfort building complex queries and analytics across large datasets.
• Experience hunting in AWS, Azure, and M365 using native telemetry such as CloudTrail, Azure Activity, M365 Unified Audit Log, and identity-provider logs.
• Adversary-emulation experience using Atomic Red Team, CALDERA, Stratus Red Team, or equivalent.
• Recent malware analysis and reverse-engineering experience.
• Hands-on experience securing or hunting within AI/ML pipelines, model registries, vector databases, and agentic systems.
• Hands-on experience with vulnerability research, penetration testing, or exploit development.
• Experience with container and Kubernetes security telemetry, including Falco, runtime security, or cloud workload protection.
• Experience consuming deception-technology outputs as a hunting data source.
• Familiarity with threat-hunting maturity models such as the Hunting Maturity Model (HMM) and ability to advance program maturity.
• Experience with insider-threat or fraud-adjacent hunting use cases.
• Published research, conference talks, CTF participation, or contributions to open-source detection content such as Sigma rules, Atomic Red Team, or hunt libraries.
• Familiarity with OT/ICS or IoT environments.
• Relevant GIAC certifications: GCTD, GCTI, GCFA, GCFE, GNFA, GREM, GDAT, or GCIA.
• Offensive certifications such as OSCP, OSCE, or CRTO.
• Cloud certifications such as AWS Security Specialty, AZ-500, or SC-200.
• AI security certifications, MITRE ATLAS training, or AI red-team credentials.
• Foundational certifications such as CISSP or CEH.
• Tool-specific certifications in Splunk, Sentinel, CrowdStrike, or similar platforms.

Responsibilities

• Lead hypothesis-driven, intelligence-led hunt campaigns from formulation through reporting, mapped to MITRE ATT&CK.
• Design and execute custom analytics against large-scale SIEM, EDR/XDR, identity, cloud, and network telemetry to uncover adversary tradecraft that evades existing detections.
• Conduct identity-centric hunts across Entra ID, Active Directory, and SaaS platforms for threats such as token theft, session hijacking, MFA bypass, OAuth abuse, and conditional-access circumvention.
• Conduct cloud-native hunts across AWS, Azure, M365, and SaaS control planes using audit logs, identity events, and workload telemetry.
• Convert hunt findings into durable detections, signatures, and SOAR playbooks in partnership with Detection Engineering.
• Perform deception operations by defining adversary-aligned use cases, authoring detection requirements for deception-generated activity, and tuning signal-to-noise thresholds.
• Use AI- and LLM-assisted tools to accelerate query generation, log summarization, entity pivoting, anomaly clustering, and pattern discovery across telemetry sources.
• Hunt in AI and LLM environments, including enterprise copilots, LLM deployments, AI agents, RAG pipelines, model endpoints, and AI/ML infrastructure, for threats such as prompt injection, model abuse, data exfiltration, agent hijacking, model supply-chain compromise, and unauthorized model access.
• Produce post-hunt reports with explicit evidence and measurable outcomes tied to exposure reduction.
• Partner with Threat Intelligence to turn finished intelligence into targeted hunt missions and provide upstream collection requirements.
• Support purple-team exercises and validate detection efficacy against adversary-emulation campaigns such as Atomic Red Team, CALDERA, and Stratus Red Team.
• Develop and maintain custom tooling and automation for hunting, investigation, and analyst efficiency.
• Mentor junior hunters and contribute to internal knowledge bases, hunt libraries, and team training.
• Support Incident Response, Forensics, and Insider Threat/Fraud investigations as a senior technical resource.
• Serve as a liaison for Threat Services across Cyber Operations and communicate findings to technical peers and executive leadership.
• Identify needs, drive solutions, and work autonomously within strategic priorities.
• Identify telemetry and visibility gaps found during hunts and partner with engineering teams to improve enterprise collection coverage.
• Develop behavioral, anomaly-based, and baseline-deviation hunt methodologies beyond known ATT&CK tradecraft.

Benefits

• Comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse.
• Monthly connectivity reimbursement for employees eligible to work from home.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed