Threat Hunter

Responsibilities

• ● As a Threat Hunter, you will actively search for cyber threats that evade traditional security solutions. Your role will involve conducting in-depth intelligence-led, hypothesis-driven analysis of TTPs and behaviours, and working cross-functionally with the Security Operations Centre Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks.
• ● Key Responsibilities
• ● Use NCC Group's HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
• ● Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections.
• ● Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content.
• ● Utilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats.
• ● Support the mapping of threat models to monitoring use cases in partnership with teams across the business.
• ● Document and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling.
• ● Provide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact.
• ● Skills, Knowledge & Expertise
• ● The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration.
• ● They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions.
• ● Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks.
• ● They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments-including hybrid or cloud-native architectures like AWS, Azure, or GCP.
• ● They will be comfortable presenting findings to stakeholders and documenting methodologies.
• ● They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.
• ● Minimum Requirements
• ● Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation.
• ● Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies.