Threat Hunter: Hypothesis-Driven Defender in Hybrid Cloud

NCC Group; Madrid; On-site; EUR 60,000 - 80,000; Full time

Benefits offered by this job

Flexible Working

Generous Holiday Allowance

Medicash & Critical Illness Scheme

Financial & Investment Benefits

Community & Volunteering Programmes

Green Car Scheme

Cycle Scheme

Special Time Off

Family Planning

Job summary

NCC Group is seeking a hands-on Threat Hunter to join our Cyber Services and Capabilities team in Madrid. You will hunt, analyse, and mitigate advanced threats using hypothesis-driven methods and our proprietary framework, working with SOC, detection engineering, privacy and engineering teams.

Responsibilities include building detections, automating hunts, and sharing findings with stakeholders. Excellent collaboration and communication are essential across fast-moving environments.

Qualifications

• Experience in Threat Hunter, Red Team, Incident Response or related roles.
• Solid understanding of MITRE ATT&CK framework and TTP analysis.
• Strong scripting/query language skills (Python, KQL, SQL, PowerShell).

Responsibilities

• Use NCC Group’s HITS Framework and MITRE ATT&CK to form hypotheses and validate hunts.
• Automate hunts and visualise results using GitLab, Sigma, Jupyter Notebooks.
• Collaborate with detection engineering to convert findings into detection content.
• Operationalise detections from internal and external threat intelligence.
• Map threat models to monitoring use cases and document methodologies.
• Provide regular reports and presentations to stakeholders.

Job description

NCC Group is seeking a hands-on Threat Hunter to join our Cyber Services and Capabilities team in Madrid. You will hunt, analyse, and mitigate advanced threats using hypothesis-driven methods and our proprietary framework, working with SOC, detection engineering, privacy and engineering teams.

Responsibilities include building detections, automating hunts, and sharing findings with stakeholders. Excellent collaboration and communication are essential across fast-moving environments.