Threat Hunter: Hypothesis-Driven Defense & Automation

NCC Group; Madrid; On-site; EUR 55,000 - 75,000; Full time

Benefits offered by this job

Flexible working

25 days holiday

Medicash & Critical Illness

Pension & Life Assurance

Share Save Scheme

Volunteer programmes

Green Car Scheme

Cycle-to-work

Special time off

Family planning benefits

Job summary

NCC Group is seeking a hands-on Threat Hunter to join the Cyber Services and Capabilities team in Madrid. You will proactively hunt for advanced threats across customer environments using a proprietary framework, aligning threat hunts with customer risk and business needs.

You will work with detection engineers and security analysts to turn findings into actionable detections, leveraging MITRE ATT&CK and a range of SIEM/EDR tools, in a fast-moving, cloud-aware environment across hybrid or

Qualifications

• Experience as Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis, or Blue Team.
• Strong familiarity with the MITRE ATT&CK framework and TTP analysis.
• Experience translating threat intelligence into actionable detections and insights.
• Ability to work autonomously while collaborating with security, engineering, and business teams.
• Proficient in scripting and queries (Python, KQL, SQL, PowerShell).

Responsibilities

• Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
• Automate hunts and visualize results using GitLab, Sigma, and Jupyter Notebooks; create reusable artifacts.
• Collaborate with detection engineers to convert hunt findings into high-fidelity detections.
• Operationalise threat intelligence into monitoring use cases for emerging threats.
• Document hunting methodologies and tooling to enable scale; provide regular stakeholder reports.

Skills

Hypothesis-driven hunting

Adversary TTP analysis

Cross-functional collaboration

Python scripting

Threat hunting

SIEM/EDR knowledge

Tools

Splunk

Microsoft Sentinel

CrowdStrike

SentinelOne

Job description

NCC Group is seeking a hands-on Threat Hunter to join the Cyber Services and Capabilities team in Madrid. You will proactively hunt for advanced threats across customer environments using a proprietary framework, aligning threat hunts with customer risk and business needs.

You will work with detection engineers and security analysts to turn findings into actionable detections, leveraging MITRE ATT&CK and a range of SIEM/EDR tools, in a fast-moving, cloud-aware environment across hybrid or