Perform root cause analysis and validate security incidents.
Correlate data from multiple security platforms.
Detection Engineering
Create and optimize SIEM detection rules and use cases.
Develop behavioral analytics and anomaly detection strategies.
Reduce false positives through continuous tuning.
Improve SOC detection coverage and security monitoring effectiveness.
Threat Intelligence
Consume commercial and open-source threat intelligence feeds.
Track threat actors, attack campaigns, and emerging vulnerabilities.
Integrate threat intelligence into hunting and detection processes.
Develop threat profiles and risk assessments.
Incident Response Support
Support containment, eradication, and recovery efforts during security incidents.
Conduct forensic investigations and evidence collection.
Assist in ransomware and cyber breach investigations.
Support post-incident reviews and lessons learned activities.
Reporting & Leadership
Prepare executive-level threat hunting reports.
Present findings and recommendations to security leadership.
Mentor junior SOC analysts.
Contribute to SOC maturity and continuous improvement initiatives.
Required Technical Skills
Security Platforms
Microsoft Sentinel
Splunk
IBM QRadar
ArcSight
LogRhythm
EDR/XDR Solutions
Microsoft Defender XDR
CrowdStrike Falcon
SentinelOne
Palo Alto Cortex XDR
Trend Micro Vision One
Cloud Security
Microsoft Azure Security
Microsoft Defender for Cloud
AWS Security Services
Google Cloud Security
Network Security
Firewalls
IDS/IPS
Proxy Security
DNS Analysis
Packet Analysis (Wireshark)
Threat Hunting Tools
KQL (Kusto Query Language)
PowerShell
Python
Sigma Rules
YARA Rules
Identity Security
Microsoft Entra ID
Active Directory
PIM/PAM
MFA & Conditional Access
Operating Systems
Windows Server
Linux
MacOS
Microsoft Security Stack Expertise (Preferred)
Microsoft Sentinel
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for Office 365
Defender for Cloud Apps
Microsoft Entra ID
Defender XDR
Purview DLP
Azure Security Center
Logic Apps & SOAR Automation
Qualifications
Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
4-8 years of SOC, Threat Hunting, Incident Response, or Security Operations experience.
Strong understanding of MITRE ATT&CK framework.
Hands-on experience in threat hunting and advanced investigations.
Experience in enterprise and cloud environments.
Preferred Certifications
Microsoft
SC-200: Security Operations Analyst
SC-100: Cybersecurity Architect
AZ-500: Azure Security Engineer
Industry Certifications
GCFA
GCIH
GCTI
CISSP
CEH
CompTIA Security+
Key Competencies
Advanced Threat Hunting
Incident Response
Threat Intelligence Analysis
Security Analytics
Detection Engineering
Log Analysis
Malware Investigation
Cyber Forensics
Automation & SOAR
Executive Reporting
Problem Solving
Stakeholder Management
Senior Threat Hunter (8-12 Years) – Additional Expectations
Lead enterprise-wide threat hunting programs.
Build custom detection content and hunting playbooks.
Develop SOC threat hunting strategy and roadmap.
Lead purple-team and adversary simulation exercises.
Mentor SOC L1/L2/L3 analysts.
Drive automation through SOAR and AI-powered security analytics.
Present threat landscape and risk assessments to CISO-level leadership.
Ideal Candidate Profile
A strong candidate should have hands-on experience with Microsoft Sentinel, Defender XDR, KQL, MITRE ATT&CK, Threat Intelligence, EDR/XDR platforms, ransomware investigations, cloud security, and advanced threat hunting across hybrid enterprise environments. This profile is highly sought after by global MSSP, banking, healthcare, and enterprise SOC organizations.
SOC Threat Hunting Analyst / Threat Hunter – Job Description
- Job Title: SOC Threat Hunting Analyst
- Experience: 4-8 Years (Senior Threat Hunter: 8-12 Years)
- Location: Hybrid / Remote / Onsite
- Department: Cyber Security Operations Center (SOC)
Role Summary
We are seeking an experienced Threat Hunting Analyst to proactively identify, investigate, and mitigate advanced cyber threats across enterprise environments. The ideal candidate will possess expertise in threat hunting, incident response, SIEM, EDR/XDR technologies, threat intelligence, and malware analysis. This role will work closely with SOC, Incident Response, Cloud Security, Infrastructure, and Security Engineering teams to strengthen organizational cyber resilience.
Key Responsibilities
Threat Hunting & Detection
Conduct proactive threat hunting across endpoints, networks, cloud platforms, and identity systems.
Identify Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and suspicious behaviors.
Develop hunting hypotheses based on threat intelligence and emerging attack trends.
Detect Advanced Persistent Threats (APTs), ransomware, insider threats, and lateral movement activities.
Leverage MITRE ATT&CK framework for adversary mapping and detection improvement.
Security Monitoring & Investigation
Analyze logs, network traffic, endpoint telemetry, and cloud events.
Investigate suspicious security activities escalated from SOC L1/L2 teams.
Perform root cause analysis and validate security incidents.
Correlate data from multiple security platforms.
Detection Engineering
Create and optimize SIEM detection rules and use cases.
Develop behavioral analytics and anomaly detection strategies.
Reduce false positives through continuous tuning.
Improve SOC detection coverage and security monitoring effectiveness.
Threat Intelligence
Consume commercial and open-source threat intelligence feeds.
Track threat actors, attack campaigns, and emerging vulnerabilities.
Integrate threat intelligence into hunting and detection processes.
Develop threat profiles and risk assessments.
Incident Response Support
Support containment, eradication, and recovery efforts during security incidents.
Conduct forensic investigations and evidence collection.
Assist in ransomware and cyber breach investigations.
Support post-incident reviews and lessons learned activities.
Reporting & Leadership
Prepare executive-level threat hunting reports.
Present findings and recommendations to security leadership.
Mentor junior SOC analysts.
Contribute to SOC maturity and continuous improvement initiatives.
Required Technical Skills
Security Platforms
Microsoft Sentinel
Splunk
IBM QRadar
ArcSight
LogRhythm
EDR/XDR Solutions
Microsoft Defender XDR
CrowdStrike Falcon
SentinelOne
Palo Alto Cortex XDR
Trend Micro Vision One
Cloud Security
Microsoft Azure Security
Microsoft Defender for Cloud
AWS Security Services
Google Cloud Security
Network Security
Firewalls
IDS/IPS
Proxy Security
DNS Analysis
Packet Analysis (Wireshark)
Threat Hunting Tools
KQL (Kusto Query Language)
PowerShell
Python
Sigma Rules
YARA Rules
Identity Security
Microsoft Entra ID
Active Directory
PIM/PAM
MFA & Conditional Access
Operating Systems
Windows Server
Linux
MacOS
Microsoft Security Stack Expertise (Preferred)
Microsoft Sentinel
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for Office 365
Defender for Cloud Apps
Microsoft Entra ID
Defender XDR
Purview DLP
Azure Security Center
Logic Apps & SOAR Automation
Qualifications
Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
4-8 years of SOC, Threat Hunting, Incident Response, or Security Operations experience.
Strong understanding of MITRE ATT&CK framework.
Hands-on experience in threat hunting and advanced investigations.
Experience in enterprise and cloud environments.
Preferred Certifications
Microsoft
SC-200: Security Operations Analyst
SC-100: Cybersecurity Architect
AZ-500: Azure Security Engineer
Industry Certifications
GCFA
GCIH
GCTI
CISSP
CEH
CompTIA Security+
Key Competencies
Advanced Threat Hunting
Incident Response
Threat Intelligence Analysis
Security Analytics
Detection Engineering
Log Analysis
Malware Investigation
Cyber Forensics
Automation & SOAR
Executive Reporting
Problem Solving
Stakeholder Management
Senior Threat Hunter (8-12 Years) – Additional Expectations
Lead enterprise-wide threat hunting programs.
Build custom detection content and hunting playbooks.
Develop SOC threat hunting strategy and roadmap.
Lead purple-team and adversary simulation exercises.
Mentor SOC L1/L2/L3 analysts.
Drive automation through SOAR and AI-powered security analytics.
Present threat landscape and risk assessments to CISO-level leadership.
Ideal Candidate Profile
A strong candidate should have hands-on experience with Microsoft Sentinel, Defender XDR, KQL, MITRE ATT&CK, Threat Intelligence, EDR/XDR platforms, ransomware investigations, cloud security, and advanced threat hunting across hybrid enterprise environments. This profile is highly sought after by global MSSP, banking, healthcare, and enterprise SOC organizations.
SOC Threat Hunting Analyst / Threat Hunter – Job Description
- Job Title: SOC Threat Hunting Analyst
- Experience: 4-8 Years (Senior Threat Hunter: 8-12 Years)
- Location: Hybrid / Remote / Onsite
- Department: Cyber Security Operations Center (SOC)
Role Summary
We are seeking an experienced Threat Hunting Analyst to proactively identify, investigate, and mitigate advanced cyber threats across enterprise environments. The ideal candidate will possess expertise in threat hunting, incident response, SIEM, EDR/XDR technologies, threat intelligence, and malware analysis. This role will work closely with SOC, Incident Response, Cloud Security, Infrastructure, and Security Engineering teams to strengthen organizational cyber resilience.
Key Responsibilities
Threat Hunting & Detection
Conduct proactive threat hunting across endpoints, networks, cloud platforms, and identity systems.
Identify Indicators of Compromise (IOCs), Indicators of Attack (IOAs), and suspicious behaviors.
Develop hunting hypotheses based on threat intelligence and emerging attack trends.
Detect Advanced Persistent Threats (APTs), ransomware, insider threats, and lateral movement activities.
Leverage MITRE ATT&CK framework for adversary mapping and detection improvement.
Security Monitoring & Investigation
Analyze logs, network traffic, endpoint telemetry, and cloud events.
Investigate suspicious security activities escalated from SOC L1/L2 teams.
Perform root cause analysis and validate security incidents.
Correlate data from multiple security platforms.
Detection Engineering
Create and optimize SIEM detection rules and use cases.
Develop behavioral analytics and anomaly detection strategies.
Reduce false positives through continuous tuning.
Improve SOC detection coverage and security monitoring effectiveness.
Threat Intelligence
Consume commercial and open-source threat intelligence feeds.
Track threat actors, attack campaigns, and emerging vulnerabilities.
Integrate threat intelligence into hunting and detection processes.
Develop threat profiles and risk assessments.
Incident Response Support
Support containment, eradication, and recovery efforts during security incidents.
Conduct forensic investigations and evidence collection.
Assist in ransomware and cyber breach investigations.
Support post-incident reviews and lessons learned activities.
Reporting & Leadership
Prepare executive-level threat hunting reports.
Present findings and recommendations to security leadership.
Mentor junior SOC analysts.
Contribute to SOC maturity and continuous improvement initiatives.
Required Technical Skills
Security Platforms
Microsoft Sentinel
Splunk
IBM QRadar
ArcSight
LogRhythm
EDR/XDR Solutions
Microsoft Defender XDR
CrowdStrike Falcon
SentinelOne
Palo Alto Cortex XDR
Trend Micro Vision One
Cloud Security
Microsoft Azure Security
Microsoft Defender for Cloud
AWS Security Services
Google Cloud Security
Network Security
Firewalls
IDS/IPS
Proxy Security
DNS Analysis
Packet Analysis (Wireshark)
Threat Hunting Tools
KQL (Kusto Query Language)
PowerShell
Python
Sigma Rules
YARA Rules
Identity Security
Microsoft Entra ID
Active Directory
PIM/PAM
MFA & Conditional Access
Operating Systems
Windows Server
Linux
MacOS
Microsoft Security Stack Expertise (Preferred)
Microsoft Sentinel
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for Office 365
Defender for Cloud Apps
Microsoft Entra ID
Defender XDR
Purview DLP
Azure Security Center
Logic Apps & SOAR Automation
Qualifications
Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
4-8 years of SOC, Threat Hunting, Incident Response, or Security Operations experience.
Strong understanding of MITRE ATT&CK framework.
Hands-on experience in threat hunting and advanced investigations.
Experience in enterprise and cloud environments.
Preferred Certifications
Microsoft
SC-200: Security Operations Analyst
SC-100: Cybersecurity Architect
AZ-500: Azure Security Engineer
Industry Certifications
GCFA
GCIH
GCTI
CISSP
CEH
CompTIA Security+
Key Competencies
Advanced Threat Hunting
Incident Response
Threat Intelligence Analysis
Security Analytics
Detection Engineering
Log Analysis
Malware Investigation
Cyber Forensics
Automation & SOAR
Executive Reporting
Problem Solving
Stakeholder Management
Senior Threat Hunter (8-12 Years) – Additional Expectations
Lead enterprise-wide threat hunting programs.
Build custom detection content and hunting playbooks.
Develop SOC threat hunting strategy and roadmap.
Lead purple-team and adversary simulation exercises.
Mentor SOC L1/L2/L3 analysts.
Drive automation through SOAR and AI-powered security analytics.
Present threat landscape and risk assessments to CISO-level leadership.
Ideal Candidate Profile
A strong candidate should have hands-on experience with Microsoft Sentinel, Defender XDR, KQL, MITRE ATT&CK, Threat Intelligence, EDR/XDR platforms, ransomware investigations, cloud security, and advanced threat hunting across hybrid enterprise environments. This profile is highly sought after by global MSSP, banking, healthcare, and enterprise SOC organizations.
