Hypothesis-Driven Threat Hunter — MITRE & Automation

NCC Group; Manchester; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Flexible Working

Holiday allowance

Pension

Life Assurance

Share Save

Volunteer Programs

Green Car Scheme

Cycle to Work

Special Time Off

Family Planning

Job summary

NCC Group in Manchester is seeking a hands-on Threat Hunter to join our Cyber Services and Capabilities team. You will identify sophisticated threats across customer environments using hypothesis-driven analysis and our proprietary hunting framework.

As a Threat Hunter you will work with the SOC Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks, leveraging internal and open source threat intel and adopting a proactive, continuous improvement mindset.

Qualifications

• Experience in threat hunting, red/blue team, incident response or threat intelligence.
• Strong understanding of the MITRE ATT&CK framework and adversary emulation.
• Ability to translate threat intel into actionable detection content and playbooks.
• Comfort presenting findings to stakeholders and documenting methodologies.

Responsibilities

• Use HITS Framework, threat intel, MITRE ATT&CK, and risk models to form hypotheses and validate through hunts.
• Automate hunts and visualise results using GitLab, Sigma, Jupyter Notebooks, and other tools.
• Collaborate with detection engineers to convert hunt findings into detections and content.
• Operationalise detections using internal threat intel feeds and open source intel.
• Map threat models to monitoring use cases with cross-team partnership.
• Document hunting methodologies, tooling, and findings for continuous improvement.
• Provide regular reports and presentations to stakeholders.

Skills

Hypothesis-driven hunting

TTP analysis

Cross-functional collaboration

Python scripting

KQL

SQL

PowerShell

MITRE ATT&CK familiarity

SIEM/EDR tools knowledge

Tools

Splunk

Microsoft

CrowdStrike

SentinelOne

Job description

NCC Group in Manchester is seeking a hands-on Threat Hunter to join our Cyber Services and Capabilities team. You will identify sophisticated threats across customer environments using hypothesis-driven analysis and our proprietary hunting framework.

As a Threat Hunter you will work with the SOC Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks, leveraging internal and open source threat intel and adopting a proactive, continuous improvement mindset.