Threat Hunter

Bonhill Partners; Greater London; On-site; GBP 70,000 - 110,000; Full time

Job summary

Bonhill Partners Ltd. is seeking a security threat hunter to proactively hunt for advanced threats across endpoints, networks, cloud and identity.

You will map detections to MITRE ATT&CK, lead high-severity incident response, and develop threat intel-informed playbooks. You will collaborate with SOC, engineering, and IAM/cloud teams to close gaps, improve visibility, and strengthen the security posture of client environments.

Qualifications

• Experience proactively hunting for advanced threats across endpoints, network, cloud and identity.
• Familiarity with MITRE ATT&CK mapping and attacker TTPs.
• Proven ability to lead incident response support for high-severity events.

Responsibilities

• Proactively hunt for advanced threats across endpoints, network, cloud, and identity using telemetry from SIEM/XDR/EDR and threat intelligence.
• Build and refine hypothesis-driven hunts (MITRE ATT&CK mapped), identifying attacker TTPs, abuse paths, and suspicious behaviors.
• Perform deep-dive investigations and root cause analysis on anomalous activity, confirming impact, scope, and dwell time.
• Develop and tune high-fidelity detections (queries/rules/use-cases) and reduce noise through continuous SIEM/XDR optimisation.
• Lead incident response support for high-severity events: containment recommendations, eradication guidance, and post-incident improvements.
• Create threat intel–informed hunting playbooks and contribute to purple teaming, tabletop exercises, and adversary emulation.
• Produce clear, executive-ready reporting and write-ups: findings, risk, remediation actions, and measurable outcomes.
• Collaborate with SOC, engineering, and IAM/cloud teams to close gaps (logging, visibility, hardening) and improve security posture.

Skills

Threat hunting

MITRE ATT&CK

SIEM/XDR/EDR

Threat intelligence

Tools

SIEM/XDR/EDR tooling

Job description

Location: London, 4 days initially, reducing to 3.

Engagement: Contract -> Perm conversion

Rate/Salary: TBC, with a view to convert.

Requirements:

• Proactively hunt for advanced threats across endpoints, network, cloud, and identity using telemetry from SIEM/XDR/EDR and threat intelligence.
• Build and refine hypothesis-driven hunts (MITRE ATT&CK mapped), identifying attacker TTPs, abuse paths, and suspicious behaviors.
• Perform deep-dive investigations and root cause analysis on anomalous activity, confirming impact, scope, and dwell time.
• Develop and tune high-fidelity detections (queries/rules/use-cases) and reduce noise through continuous SIEM/XDR optimisation.
• Lead incident response support for high-severity events: containment recommendations, eradication guidance, and post-incident improvements.
• Create threat intel–informed hunting playbooks and contribute to purple teaming, tabletop exercises, and adversary emulation.
• Produce clear, executive-ready reporting and write-ups: findings, risk, remediation actions, and measurable outcomes.
• Collaborate with SOC, engineering, and IAM/cloud teams to close gaps (logging, visibility, hardening) and improve security posture.