Threat Hunter: Proactive Cyber Defender in Madrid

NCC Group; Comunidad de Madrid; Sur place; EUR 70 000 - 90 000; Plein temps

Avantages offerts par ce poste

Flexible Working

25 days annual leave + buy up to 5

Medicash & Critical Illness Scheme

Pension, Life Assurance and Share Save

Volunteering programmes

Green Car Scheme

Cycle-to-work

Résumé du poste

NCC Group is seeking a highly capable Threat Hunter in Madrid to proactively identify sophisticated adversaries using hypothesis-driven analysis and automation. You will work across Security Operations, Detection Engineering and Engineering to mitigate risks and strengthen detections.

Ideal candidates have hands-on threat hunting experience, strong MITRE ATT&CK knowledge, and proficiency in Python, KQL and PowerShell, with cloud experience across AWS/Azure/GCP and SIEM/EDR toolchains.

Qualifications

• Experience in threat hunting, red/blue team, incident response or threat intelligence roles.
• Strong understanding of MITRE ATT&CK framework, TTP analysis, and adversary emulation.
• Hands-on experience building hypothesis-driven threat-hunting frameworks and methodologies.
• Ability to work autonomously while collaborating with security, engineering and business teams.
• Strong scripting/query language skills (Python, KQL, SQL, PowerShell).

Responsabilités

• Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
• Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections.
• Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content.
• Utilise internal and open-source threat intelligence to operationalise detections for emerging threats.
• Support mapping of threat models to monitoring use cases with cross-functional teams.
• Document and maintain a robust repository for hunting methodologies, tooling and findings.
• Provide regular reports and presentations to stakeholders outlining threats, methods and risk impact.

Connaissances

Threat hunting

Hypothesis-driven hunting

MITRE ATT&CK

TTP analysis

Cross-functional collaboration

Python scripting

KQL

PowerShell

SQL

Cloud security

Outils

Splunk

Microsoft security stack

CrowdStrike

SentinelOne

GitLab

Sigma

Jupyter Notebooks

Description du poste

NCC Group is seeking a highly capable Threat Hunter in Madrid to proactively identify sophisticated adversaries using hypothesis-driven analysis and automation. You will work across Security Operations, Detection Engineering and Engineering to mitigate risks and strengthen detections.

Ideal candidates have hands-on threat hunting experience, strong MITRE ATT&CK knowledge, and proficiency in Python, KQL and PowerShell, with cloud experience across AWS/Azure/GCP and SIEM/EDR toolchains.