Senior Threat Hunting Specialist

Fortinet•Burnaby, BC

5d•CA$101,600 - CA$124,200

About The Position

We are hiring a Senior Threat Hunting Specialist who combines deep threat-hunting expertise with practical purple-team simulation skills to support an AI-driven detection program. The ideal candidate understands attacker TTPs in depth, can design hypothesis-driven hunts from telemetry, and can script concise attack simulations to generate realistic logs and telemetry in a test environment for validating detections. This role focuses on attacker thinking, preparing and conducting simulations, threat detection SIEM query design and SOC detection validation. Moreover, this role will contribute to features design for ML-driven detection capabilities.

Requirements

5+ years’ experience in threat hunting, SOC/IR, Blue\Red\Purple team experince, or related security roles with demonstrable hunting casework.
Strong understanding of attacker techniques and the ability to decompose attack chains (MITRE ATT&CK fluency).
Proven ability to propose hunting hypotheses and identify relevant telemetry fields/signals.
Experience collaborating with ML or data science teams to define feature requirements, labeling strategies, and validation criteria.
Proficient with ClickHouse and PostgreSQL, and able to produce clear, high-quality security analysis reports based on telemetry and hunting findings.
Practical scripting ability for attack simulation and PoC generation (Python required; PowerShell/Bash/other scripting as applicable). Note: production engineering and model training are handled by the team.
Familiarity with common hunting/detection platforms and telemetry sources (SIEM, EDR/XDR, network and cloud logs, container telemetry).
Strong analytical reasoning, incident investigation mindset, and excellent written/verbal communication skills.

Nice To Haves

Industry certifications: GIAC GCFA, GCTI, OSCP/OSCE.
Hands-on red team / adversary emulation experience beyond simple PoCs.
Familiarity with SOAR products and concepts.
Familiarity with ML concepts and validation metrics.
Familiarity with Fortinet product telemetry and tooling — e.g., FortiAnalyzer and FortiSIEM for aggregated and correlation logs, FortiGate traffic/event logs, and FortiEDR endpoint telemetry. Able to map Fortinet event fields to hunting features and to explain which Fortinet logs provide the signals needed for specific TTPs.

Responsibilities

Perform hypothesis-driven threat hunting projects and translate attacker TTPs into measurable telemetry signals (IOAs/IOCs) suitable for ML feature design.
Collaborate with ML engineers and data scientists to define, propose, and validate candidate features.
Specify feature engineering transformations, labeling rules, sampling strategies, and evaluation metrics; support feature importance and explainability analysis.
Create hypothesis-driven detection reports and dashboards from telemetry sources and perform threat hunting investigations using the insights surfaced by those reports.
Design and execute controlled red-team style simulations (scripted PoCs) in test environments to create labeled datasets for training and validation; ensure simulations are realistic, diverse, and safely scoped.
Track emerging threats, map them to MITRE ATT&CK, and propose new simulation scenarios and detection features as adversaries evolve.