Threat Hunter

Description

Key Responsibilities

• Use the HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
• Use GitLab, Sigma, Jupyter Notebooks, and other tools to automate hunts, visualize results, and create reusable artifacts.
• Convert threat-hunting findings into high-fidelity detection content with detection engineering.
• Operationalize detections for emerging threats using internal and open-source threat intelligence.
• Support mapping threat models to monitoring use cases across the business.
• Maintain repositories for hunting methodologies, tooling, and findings.
• Present reports explaining threats, methods, and risk impact.

Skills, Knowledge and Expertise

• Experience in Threat Hunting, Red Team, Blue Team, Incident Response, Threat Intelligence, or Malware Analysis.
• Solid understanding of MITRE ATT&CK, TTP analysis, and adversary emulation.
• Deep familiarity with hypothesis-driven threat-hunting frameworks and methodologies.
• Experience with one or more SIEM or EDR stacks, including Splunk, Microsoft, CrowdStrike, or SentinelOne.
• Experience translating threat intelligence into actionable insights and operationalizing findings.
• Ability to work across complex environments, including hybrid or cloud-native architectures such as AWS, Azure, or GCP.
• Comfort presenting findings to stakeholders and documenting methodologies.

What We Are Looking For

• Ability to work autonomously while collaborating across security, engineering, and business teams.
• Strong scripting or query-language skills, such as Python, KQL, SQL, or PowerShell.
• Curiosity, methodical thinking, and a commitment to improving visibility and detection coverage.

Job Benefits

• Flexible working options are available.
• Benefits include holiday allowance, health and illness schemes, pension and life assurance, share savings, volunteering programmes, and family support.

About NCC Group