jobapplier

Threat Hunter

NCC Group

Skills

Required

  • MITRE
  • ATT&CK framework
  • Incident Response / Threat Intelligence / Malware Analysis / Blue
  • TTP analysis
  • scripting/query language
  • operationalise findings
  • hypothesis-driven hunting
  • Python
  • SQL
  • PowerShell

Preferred

  • detection
  • TTPs and
  • AWS / Azure / GCP
  • documenting methodologies

Join our industry-leading team as a Threat Hunter, where you will proactively identify and analyze advanced cyber threats. You will use our proprietary hunting framework and collaborate with various teams to mitigate risks. Your role will involve conducting in-depth analysis, automating hunts, and converting findings into high-fidelity detection content. You should have hands-on experience in threat hunting, a deep understanding of the MITRE ATT&CK framework, and strong scripting/query language skills.

About NCC Group

They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions

They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats

Responsibilities

  • Proactively hunt and analyze advanced threats across the customer's environment using proprietary hunting frameworks.
  • Conduct in-depth intelligence-led, hypothesis-driven analysis of TTPs and behaviors, and work cross-functionally to mitigate risks.
  • Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content and operationalize detections for emerging threats.
  • They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments—including hybrid or cloud-native architectures like AWS, Azure, or GCP
  • They will be comfortable presenting findings to stakeholders and documenting methodologies

Requirements

  • Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings
  • The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration
  • Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks
  • Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation
  • Strong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell)
  • Ability to work autonomously while collaborating across security, engineering, and business teams
  • Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies
  • Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team role