Threat Hunting Specialist | Digital Threat Researcher

Abu Dhabi Berkeley Services LLC; Abu Dhabi; On-site; AED 180,000 - 260,000; Full time

Job summary

Abu Dhabi Berkeley Services LLC is seeking a mid-to-senior Threat Hunting Specialist / Digital Threat Researcher to identify hidden cyber threats and conduct in-depth security research. You will collaborate with security operations, incident response, malware research, and IT teams to detect advanced threats and strengthen defenses.

The role requires strong knowledge of attack methodologies, network/endpoint security, threat intelligence, and digital investigation techniques.

Qualifications

• Bachelor's degree in cybersecurity, computer science, or a related field.
• Experience in threat hunting, cyber threat intelligence, security operations, or incident response.
• Strong understanding of cyberattack methods and enterprise security environments.
• Familiarity with MITRE ATT&CK framework and threat actor TTPs.
• Experience analyzing security logs, endpoint telemetry, network traffic, and system activity.
• Proficiency with SIEMs such as Splunk, Microsoft Sentinel, IBM QRadar.
• Experience with EDR/XDR platforms and endpoint investigation.
• Ability to write detection queries using KQL, SPL, Sigma, or YARA.

Responsibilities

• Conduct proactive threat hunting to identify suspicious activity and security incidents.
• Analyze endpoint, network, cloud, and system telemetry for hidden threats.
• Investigate unusual system activity, unauthorized access, and abnormal network communications.
• Develop and test threat hunting hypotheses based on threat intel and attack techniques.
• Research APTs, ransomware campaigns, phishing operations, and other cyberattack activity.
• Correlate events to identify relationships across systems and campaigns.
• Monitor SIEM and EDR alerts for indicators of compromise.
• Prepare detailed threat research reports and actionable recommendations.
• Collaborate with incident response, vulnerability management, and IT teams.

Skills

Threat hunting

Threat intelligence

Security operations

Incident response

Digital threat research

Analytical skills

Report writing

Communication skills

Vulnerability management

Python scripting

Education

Bachelor's degree in Cybersecurity

Tools

Splunk

Microsoft Sentinel

IBM QRadar

EDR/XDR

KQL

SPL

Sigma

YARA

Job description

We’re Hiring: Threat Hunting Specialist | Digital Threat Researcher

Employment Type: Full-Time

Level: Mid-Level to Senior

We are seeking a highly analytical, proactive, and security-focused Threat Hunting Specialist | Digital Threat Researcher to identify hidden cyber threats, investigate suspicious activities, and conduct in-depth research into emerging digital attack techniques. This role combines proactive threat hunting, cybersecurity intelligence, threat analysis, incident investigation, and security monitoring.

The successful candidate will work closely with security operations, incident response, malware research, and IT infrastructure teams to detect advanced threats, investigate potential compromises, analyze attacker behavior, and strengthen organizational security capabilities. The ideal candidate has a strong understanding of cyberattack methodologies, network security, endpoint monitoring, threat intelligence, and digital investigation techniques.

Key Responsibilities

• Conduct proactive threat hunting activities to identify suspicious behavior and potential security incidents across enterprise environments.
• Analyze endpoint, network, cloud, and system telemetry to uncover hidden threats that may bypass conventional security controls.
• Investigate unusual system activities, unauthorized access attempts, suspicious processes, and abnormal network communications.
• Develop and execute threat hunting hypotheses based on known attack techniques, threat intelligence, and emerging cyber risks.
• Research advanced persistent threats (APTs), ransomware campaigns, phishing operations, and other sophisticated cyberattack activities.
• Analyze attacker tactics, techniques, and procedures (TTPs) to understand potential intrusion methods and operational patterns.
• Monitor security alerts, event logs, endpoint detection systems, and network monitoring platforms for indicators of malicious activity.
• Conduct investigations into potential data breaches, account compromises, lateral movement, and unauthorized data transfers.
• Correlate security events across multiple systems to identify relationships between suspicious activities and possible attack campaigns.
• Analyze indicators of compromise (IOCs), including malicious IP addresses, domains, file hashes, URLs, and suspicious behavioral patterns.
• Use threat intelligence platforms and external research sources to identify emerging threats and assess their relevance to organizational environments.
• Perform research into cybercriminal groups, threat actors, attack infrastructure, and evolving exploitation techniques.
• Conduct digital investigations to determine the scope, timeline, and potential impact of security incidents.
• Collaborate with incident response teams to investigate confirmed threats and support containment and remediation activities.
• Develop and refine threat hunting queries, detection rules, and analytical techniques to improve threat identification.
• Utilize security information and event management (SIEM) platforms to investigate logs and detect abnormal activity.
• Work with endpoint detection and response (EDR) tools to investigate suspicious processes, endpoint behaviors, and potential compromises.
• Analyze network traffic, DNS records, authentication events, and firewall logs to identify malicious communication patterns.
• Support the development of detection logic using tools and languages such as KQL, SPL, Sigma, YARA, or equivalent technologies.
• Map identified attack behaviors to established frameworks such as MITRE ATT&CK.
• Evaluate the effectiveness of existing security monitoring controls and recommend improvements.
• Conduct research into newly disclosed vulnerabilities, exploitation methods, and security weaknesses.
• Identify gaps in threat detection coverage and recommend additional monitoring strategies.
• Prepare detailed threat research reports, investigation summaries, and technical recommendations.
• Communicate threat findings and risk assessments to cybersecurity teams, management, and relevant stakeholders.
• Maintain and improve threat intelligence repositories, investigation records, and security research documentation.
• Collaborate with vulnerability management teams to assess threats associated with exposed systems and unpatched software.
• Support security awareness initiatives by sharing relevant threat trends, attack scenarios, and defensive recommendations.
• Monitor cybersecurity developments, industry reports, and threat intelligence publications to maintain awareness of emerging risks.
• Recommend improvements to threat detection, security monitoring, and incident investigation processes.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, Computer Engineering, or a related field.
• Relevant experience in threat hunting, cyber threat intelligence, security operations, incident response, or digital threat research.
• Strong understanding of cybersecurity principles, common attack techniques, and enterprise security environments.
• Knowledge of attacker tactics, techniques, and procedures (TTPs), including those documented in the MITRE ATT&CK framework.
• Experience analyzing security logs, endpoint telemetry, network traffic, and system activity.
• Familiarity with SIEM platforms such as Splunk, Microsoft Sentinel, IBM QRadar, or equivalent solutions.
• Experience using EDR or XDR platforms for endpoint investigation and threat detection.
• Understanding of network protocols, DNS, HTTP/HTTPS, authentication mechanisms, and enterprise network architecture.
• Knowledge of malware behavior, phishing techniques, ransomware operations, and common intrusion methods.
• Familiarity with threat intelligence platforms, IOC analysis, and cyber threat research methodologies.
• Ability to develop and execute threat hunting hypotheses using structured analytical approaches.
• Experience writing detection queries or rules using KQL, SPL, SQL, Sigma, YARA, or similar technologies.
• Understanding of Windows, Linux, and cloud environments and their relevant security logs.
• Familiarity with scripting languages such as Python, PowerShell, or Bash is advantageous.
• Ability to investigate suspicious processes, unauthorized access, lateral movement, and abnormal system behavior.
• Strong analytical and problem-solving skills with the ability to identify patterns across large volumes of security data.
• Understanding of vulnerability management, exploitation techniques, and security assessment principles.
• Ability to correlate multiple indicators and distinguish legitimate activity from potential malicious behavior.
• Strong technical documentation and report-writing skills.
• Excellent communication skills for presenting research findings and investigation results.
• Ability to work effectively with security operations, incident response, IT infrastructure, and vulnerability management teams.
• Strong attention to detail when handling security evidence, investigation records, and threat intelligence.
• Ability to prioritize investigations and respond effectively to evolving cybersecurity threats.
• Professional judgment and responsibility when handling confidential security information.
• Proactive mindset with a strong interest in continuous cybersecurity research and threat intelligence development.
• Relevant certifications in threat hunting, incident response, security operations, or cyber threat intelligence are advantageous.

What We Offer

• Competitive salary and comprehensive employee benefits.
• Opportunities to investigate advanced cyber threats and emerging attack techniques.
• Exposure to modern threat hunting platforms, security monitoring systems, and intelligence tools.
• Professional development in cyber threat intelligence, incident response, and security research.
• Opportunities to collaborate with cybersecurity analysts, incident responders, and technical specialists.
• Access to enterprise security technologies, threat intelligence resources, and analytical platforms.
• A technology-focused working environment that encourages research, innovation, and continuous learning.
• Opportunities to contribute to threat detection strategies and organizational security improvements.
• Support for relevant cybersecurity training and professional certifications.
• Opportunities to strengthen technical investigation, analytical, and research capabilities.
• Career progression toward Senior Threat Hunting Specialist, Cyber Threat Intelligence Manager, Threat Research Lead, or Head of Threat Intelligence.