Threat Hunter

Cyber Security – Senior Threat Hunter

The opportunity:

We are looking for SOC L3 Threat Hunter is responsible for proactively identifying advanced, stealthy, and previously unknown threats across enterprise environments. This role operates beyond alert-driven SOC operations, focusing on hypothesis-based threat hunting, adversary behaviour analysis, and closing detection gaps across Microsoft Sentinel, Microsoft Defender for Endpoint, and Defender for IoT.

The role serves as a technical authority within the SOC, supporting L1/L2 analysts, partnering with Incident.Response and Detection Engineering teams, and continuously improving the organization’s threat visibility and SOC maturity.

Your key responsibilities:

· Conduct hypothesis-driven, TTP-centric threat hunts using telemetry from Microsoft
Sentinel and Microsoft Defender platforms.

· Develop hunt hypotheses based on:

Adversary campaigns

MITRE ATT&CK techniques

Threat intelligence

Observed environmental weaknesses

· Hunt for advanced attack behaviors.

· Validate findings with evidence and determine impact before escalation.

· Perform advanced KQL-based threat hunting across large data volumes in Microsoft
Sentinel.

· Identify detection blind spots, noisy analytics, and data quality issues.

· Conduct advanced endpoint hunting using Defender Advanced Hunting

· Correlate endpoint telemetry with SIEM data to reconstruct end-to-end kill chains.

· Perform threat hunting across IoT/OT and ICS environments using Microsoft Defender
for IoT telemetry where applicable

· Produce formal threat hunt reports detailing: Hunt Hypothesis, Data Sources, Findings
and evidence, MITRE ATT&CK mapping and recommended remediation

Skills and attributes for success:

· 4–7+ years in SOC, Threat Hunting, Incident Response, or Detection Engineering.

· Proven experience performing proactive threat hunting (not tool monitoring).

· Experience working in enterprise-scale SIEM and EDR environments.

· Advanced expertise in MS Sentinel and Defender Suites

· Strong mastery of KQL (Kusto Query Language)

· Deep understanding of MITRE ATT&CK, Adversary tradecraft, Malware and
post-exploitation techniques

· Strong skills in Endpoint telemetry analysis, Network traffic analysis, Log correlation
across multiple security layers

· Advanced analytical and critical-thinking skills

· Strong written and verbal communication