Principal Threat Hunter | Remote, USA

Optiv • Overland Park, KS

21h • Remote

About The Position

Optiv is hiring a Principal Threat Hunter for a fully remote role available anywhere in the continental United States. The team provides 24/7 support, and the position requires shift flexibility, including rotating between day, mid, and night shifts. The role focuses on proactively identifying and analyzing potential security incidents in client environments, advising clients on threats and vulnerabilities, and coordinating urgent security-event response, containment, and remediation.

The Principal Threat Hunter leads, mentors, and develops threat hunters and analysts, and serves as a subject matter expert for internal teams and client counterparts. The role assesses the effectiveness of client security platforms, applies open-source intelligence and client data to demonstrate adversary risk, and recommends mitigation, detection, and policy improvements. It also involves staying informed about security technologies, collaborating with senior and principal analysts, advising multiple clients on their security posture, and maintaining procedures and knowledge bases that support content development, analysis, response, and client action.

Requirements

• A Bachelor of Science or master's degree in Cyber Security, Computer Science, computer/software engineering, or another applicable focus area, combined with 8 or more years of experience in Incident Response, Blue Team, and/or Red Team technical operations; or equivalent education and training documented through certifications, performance evaluations, course diplomas, or official memoranda.
• Leadership experience developing people or operations, and completing projects, tasks, and problem solving.
• Experience in at least three of the following: incident response processes, detection engineering, malware analysis, network analysis, threat intelligence reporting and analysis, attack and penetration testing, digital forensics, or cyber threat emulation.
• Experience with cyber threat methodologies, including the Cyber Kill Chain, Pyramid of Pain, MITRE ATT&CK Matrix, and Diamond Model, and applying them to enterprise cyber operations.
• Strong understanding of cybersecurity topics and current adversary tactics, techniques, and procedures.
• Strong understanding of Windows and Linux internals.
• A combination of skills covering offensive and defensive security practices.
• Proven scripting experience with Python, PowerShell, Bash, WMIC, or other languages.
• Experience with the threat-hunting lifecycle and application of tools.
• Excellent oral and written communication skills, including the ability to make clear, concise presentations to various audiences with executive presence.

Nice To Haves

• Relevant information security certifications such as GCFA, GCIA, GREM, GCIH, CEH, or OSCP.
• Expert-level knowledge of security tools such as CrowdStrike, CarbonBlack, Tanium, Splunk, Anomali, Sentinel, and Vectra.
• Expert-level knowledge of tool integrations for data correlation and automation.

Responsibilities

• Proactively analyze, document, and report on potential security incidents identified in client environments.
• Collaborate with internal and client partners to maintain an understanding of threats, vulnerabilities, and exploits that could affect systems, networks, and assets.
• Serve as the primary point of contact and coordinator for clients during security events requiring urgent response, containment, and remediation.
• Lead, mentor, and develop other threat hunters and analysts.
• Perform security gap analyses and effectiveness assessments of security technologies and platforms, including SIEM, SOAR, XDR, EDR, content development collaboration solutions, network security devices, web application security, asset management, and vulnerability scanners.
• Stay informed about new security technologies and assess opportunities to improve client security programs or achieve client outcomes.
• Use OSINT and client data to demonstrate adversary risk and develop recommendations to reduce risk, including mitigation techniques and data to inform detection content or client policies.
• Solicit and collaborate with senior and principal analysts to inform threat-hunting activities.
• Discuss security posture with multiple clients and recommend improvements to their holistic security approaches.
• Lead, mentor, and influence internal teams and client counterparts as a subject matter expert.
• Develop and maintain SOPs and knowledge bases that support effective content development, analyst understanding and response, and client action items.

Benefits

• Inclusive value supported through Employee Resource Groups.
• Work/life balance.
• Professional training resources.
• Creative problem-solving opportunities and the ability to tackle unique, complex projects.
• Volunteer opportunities through Optiv Chips In, which encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to work productively remotely/from home, where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal