Staff Threat Hunter

TENEX.AI • Overland Park, KS

6d • Onsite

About The Position

As Staff Threat Hunter, you'll own how TENEX hunts — the methodology, the tooling, the hypotheses, and the conversion of hunt findings into production detections. You'll work across multi-tenant MDR telemetry in Google SecOps / Chronicle, partnering with detection engineering to close the gaps automated alerting misses. This is a senior IC role — you set the technical direction for how hunting works at TENEX. Reports to the VP, Security.

Requirements

• 8+ years in threat hunting, SOC, or incident response, with at least 3 in a senior/lead capacity
• Deep hands-on experience running hypothesis-driven hunts across SIEM and EDR telemetry in enterprise or MDR environments
• Hands-on hunting experience in Google SecOps / Chronicle, or equivalent cloud-native SIEM (Sentinel, Splunk Cloud) with willingness to standardize on Chronicle
• Strong command of attacker TTPs and MITRE ATT&CK — you can map an intrusion from initial access through impact and explain the detection gap at each stage
• Scripting fluency in Python and/or PowerShell for hunt tooling, telemetry parsing, and detection automation

Nice To Haves

• Microsoft security stack (Sentinel, Defender) depth
• SOAR platform experience (Tines, XSOAR, Chronicle SOAR)
• Cloud security depth in AWS, Azure, or GCP, including cloud-native attack patterns
• Published research, conference talks, or open-source contributions in threat hunting or detection engineering

Responsibilities

• Lead proactive, hypothesis-driven hunts. Run investigations across SIEM, EDR, network, and identity telemetry to surface the threats automated detection misses.
• Own the hunt methodology. Build, document, and refine the playbooks the team runs from. Decide what gets hunted, on what cadence, and how findings convert into permanent detections.
• Drive the detection engineering partnership. Work directly with detection engineers to turn hunt findings into production rules and analytics in Google SecOps / Chronicle.
• Operationalize Threat Intelligence. Track adversary TTPs relevant to our customer base, prioritize what matters, and translate intel into hunt hypotheses.
• Mentor SOC analysts and junior hunters. Pair on investigations, lead technical deep-dives, and grow the team's hunt capability.
• Lead complex incident investigations. When a hunt surfaces a real intrusion, run the technical investigation alongside incident response through containment.
• Report on program outcomes. Communicate findings to customers and internal stakeholders — what was found, what was contained, where the detection coverage gap was, and what we changed.

Benefits

• Competitive salary and benefits package.
• A culture of growth and development, with opportunities to expand your knowledge in AI, cybersecurity, and emerging technologies.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior