Principal Threat Hunter | Remote, USA

Optiv • Overland Park, KS

3d • Remote

About The Position

Optiv is seeking a Principal Threat Hunter to proactively identify, analyze, document, and report potential security incidents in client environments. The role supports clients during security events requiring urgent response, containment, and remediation, and partners with internal teams and clients to understand threats, vulnerabilities, and exploits that could affect their systems and assets.

The Principal Threat Hunter assesses security gaps and the effectiveness of security technologies, applies open-source intelligence and client data to demonstrate adversary risk, and recommends mitigations and improvements to detection content or client policies. The role also evaluates emerging security technologies and advises clients on their overall security posture.

As a subject matter expert, this position leads, mentors, and develops threat hunters, analysts, internal teams, and client counterparts. It also develops and maintains standard operating procedures and knowledge bases to support content development, analyst response, and client action items. The position is fully remote within the continental United States and requires flexibility to rotate between day, mid, and night shifts to support a 24/7 team.

Requirements

• Bachelor of Science or master's degree in cybersecurity, computer science, computer/software engineering, or another applicable focus area, combined with 8 or more years of experience in incident response, Blue Team, and/or Red Team technical operations; alternatively, equivalent education and training documented through certifications, performance evaluations, course diplomas, or official memoranda.
• Leadership experience developing people or operations, as well as completing projects and tasks and solving problems.
• Experience in at least three of the following areas: incident response processes, detection engineering, malware analysis, network analysis, threat intelligence reporting and analysis, attack and penetration testing, digital forensics, or cyber threat emulation.
• Experience with cyber threat methodologies, including the Cyber Kill Chain, Pyramid of Pain, MITRE ATT&CK Matrix, and Diamond Model, and applying them to enterprise cyber operations.
• Strong understanding of cybersecurity topics and current threat-adversary TTPs.
• Strong understanding of Windows and Linux internals.
• A combination of skills covering offensive and defensive security practices.
• Proven scripting experience with Python, PowerShell, Bash, WMIC, or other languages.
• Experience with the threat-hunting lifecycle and application of tools.
• Excellent oral and written communication skills, including the ability to deliver clear, concise presentations to varied audiences with executive presence.
• Ability to work flexibly across day, mid, and night shifts in support of a 24/7 team.

Nice To Haves

• GCFA, GCIA, GREM, GCIH, CEH, OSCP, or other relevant information security certifications.
• Expert-level knowledge of security tools such as CrowdStrike, CarbonBlack, Tanium, Splunk, Anomali, Sentinel, and Vectra.
• Expert-level knowledge of tool integrations for data correlation and automation.

Responsibilities

• Proactively analyze, document, and report potential security incidents identified in client environments.
• Collaborate with internal and client partners to maintain awareness of security threats, vulnerabilities, and exploits that could affect systems, networks, and assets.
• Serve as the primary point of contact and coordinator for clients during security events requiring urgent response, containment, and remediation.
• Lead, mentor, and develop threat hunters and analysts.
• Conduct security gap analysis and assess the effectiveness of security platform technologies, including SIEM, SOAR, XDR, EDR, content development collaboration solutions, network security devices, web application security, asset management, and vulnerability scanners.
• Monitor new security technologies and assess opportunities to improve client security programs or achieve client outcomes.
• Apply OSINT and client data to demonstrate adversary risk and develop recommendations to reduce risk, including mitigation techniques and data to inform detection content or client policies.
• Solicit and collaborate with senior and principal analysts to incorporate observations into threat-hunt activities.
• Discuss security posture with multiple clients and recommend improvements to their holistic security approach.
• Lead, mentor, and influence internal teams and client counterparts as a subject matter expert.
• Develop and maintain SOPs and knowledge bases that support content development, analyst understanding and response, and client action items.

Benefits

• Employee Resource Groups and a commitment to inclusion.
• Work/life balance.
• Professional training resources.
• Creative problem-solving and opportunities to tackle unique, complex projects.
• Volunteer opportunities through Optiv Chips In.
• Technology and resources to work productively remotely/from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior