Cyber Threat Hunter — Proactive Defender

Capgemini; Málaga; On-site; EUR 48,000 - 72,000; Full time

Benefits offered by this job

Wellbeing HUB

Flexible Compensation Plan

Continuous Learning

Volunteer & Social Impact Programs

Buddy Program

Life & Accident Insurance

Job summary

Capgemini in Málaga, Spain, seeks an experienced Cyber Threat Hunting Analyst to proactively hunt for signs of attackers before incidents occur. You will analyze telemetry across endpoints, networks, and logs, build hypothesis-driven hunts, and collaborate with SOC and infrastructure teams to strengthen security.

English proficiency is essential for international collaboration. The role emphasizes proactive threat hunting, detection tuning, and cross-tool correlation within a global security

Qualifications

• Minimum 2 years of experience in Cyber Threat Hunting.
• High level of English; ability to communicate with international teams.

Responsibilities

• Proactively conduct threat hunts to identify malicious activity that bypassed automated detections.
• Develop hypothesis-driven hunts using MITRE ATT&CK framework.
• Analyse endpoint, network, and log telemetry to detect indicators of compromise and anomalies.
• Investigate credential misuse, lateral movement, persistence, and living-off-the-land techniques.
• Correlate data across SIEM, EDR/XDR, and network tools to validate threats and scope impact.
• Leverage threat intelligence and internal telemetry to identify emerging attacker behaviors.
• Support incident investigations with root-cause analysis and attacker activity reconstruction.
• Identify detection/logging gaps and work with detection engineering to improve coverage.
• Tune detections to reduce false positives and improve signal quality.
• Collaborate with SOC, incident responders, and infrastructure teams to improve security posture.

Skills

Cyber Threat Hunting

English

Job description

Capgemini in Málaga, Spain, seeks an experienced Cyber Threat Hunting Analyst to proactively hunt for signs of attackers before incidents occur. You will analyze telemetry across endpoints, networks, and logs, build hypothesis-driven hunts, and collaborate with SOC and infrastructure teams to strengthen security.

English proficiency is essential for international collaboration. The role emphasizes proactive threat hunting, detection tuning, and cross-tool correlation within a global security