Threat Hunting Engineer | Hybrid Work & Continuous Growth

Thales España; Madrid; Hybrid; EUR 60,000 - 90,000; Full time

Benefits offered by this job

Flexible hybrid work

Up to 41 days off per year

One free Friday per month

Career growth and certifications

Job summary

Thales S21sec Spain is seeking a Threat Hunting Engineer to lead proactive defense initiatives, incident response, and forensic investigations. You will act as a technical driver for defense playbooks and scale security in distributed environments.

The role requires 3+ years in cybersecurity with deep SIEM/EDR expertise, MITRE ATT&CK knowledge, and cloud security experience. Hybrid work options in Madrid are available with a strong focus on continuous learning and career growth.

Qualifications

• 3+ years in cybersecurity with focus on Security Operations, Incident Response and Threat Hunting.
• Senior-level experience in a team with complex technical challenges.
• Experience managing security operations in high-scale distributed environments (Cloud or Hybrid).
• Strong understanding of attacker TTPs and MITRE ATT&CK framework.
• Deep expertise in SIEM/SOAR, EDR/XDR, and network traffic analysis.
• Experience with Cloud security (AWS, Azure, or GCP) and shared responsibility models.
• Experience leading large-scale incident investigations and root-cause analysis.
• Familiarity with forensic analysis tools and procedures.

Responsibilities

• Drive proactive defense by leading threat hunting strategies using telemetry and intelligence.
• Lead incident response and guide the team through high-pressure situations.
• Mentor others through technical workshops and collaboration.
• Architect security integrations with cloud and product teams across the lifecycle.

Skills

Threat Hunting

Incident Response

MITRE ATT&CK

Cloud Security

Tools

SIEM/SOAR

EDR/XDR

Network traffic analysis

Cloud platforms (AWS/Azure/GCP)

Job description

Thales S21sec Spain is seeking a Threat Hunting Engineer to lead proactive defense initiatives, incident response, and forensic investigations. You will act as a technical driver for defense playbooks and scale security in distributed environments.

The role requires 3+ years in cybersecurity with deep SIEM/EDR expertise, MITRE ATT&CK knowledge, and cloud security experience. Hybrid work options in Madrid are available with a strong focus on continuous learning and career growth.