Threat Hunting Investigator

Job Summary

To support a leading technology and cybersecurity organization, the Threat Hunting Investigator will engage in long-term remote consulting, focusing on identifying insider risk activity, developing advanced security detections, and protecting sensitive intellectual property through proactive investigations and threat analysis.

Key responsibilities:

• Lead proactive threat hunting efforts utilizing endpoint, identity, cloud, and network telemetry to identify suspicious user behavior and insider risk activity
• Design, build, and optimize advanced detections, correlation searches, and risk-based alerting workflows within Splunk Enterprise Security and related security platforms
• Transform threat intelligence and investigative findings into scalable detection content, response procedures, and operational playbooks

Required qualifications:

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical discipline
• 8+ years of experience in cyber investigations, insider threat analysis, incident response, threat hunting, or digital forensic examinations
• 5+ years of hands-on experience developing and maintaining security detections within Splunk, including SPL development and Risk-Based Alerting (RBA)
• Experience creating production-ready detection logic and measurable security use cases from initial threat hypotheses
• Strong understanding of endpoint security, cloud-based telemetry, and user behavior analytics platforms