Threat Hunting Investigator

Job Summary

To support a leading technology organization, the remote Threat Hunting Investigator will conduct proactive threat investigations focused on insider threats and suspicious user activity while developing advanced Splunk detection content and optimizing detection workflows during EST business hours.

Key responsibilities

• Conduct proactive threat hunting and investigations related to insider threats and suspicious user activity
• Develop, test, deploy, and tune advanced Splunk detection content using SPL and correlation searches
• Produce clear investigative reports and actionable recommendations for security stakeholders

Required qualifications

• 5+ years of experience in digital threat investigations and insider threat analysis
• Advanced hands-on experience with Splunk Enterprise Security and complex SPL query authoring
• Strong experience in developing Risk-Based Alerting (RBA) and User and Entity Behavior Analytics (UEBA) programs
• Proven ability to translate threat intelligence into production-ready detections and security workflows