Threat Hunter – Hypothesis-Driven Cyber Defense Expert

NCC Group; Manchester; Hybrid; GBP 70,000 - 95,000; Full time

Benefits offered by this job

Flexible Working

Generous Holiday Allowance

Medicash & Critical Illness Scheme

Pension & Life Assurance

Share Save Scheme

Community & Volunteering Programmes

Green Car Scheme

Cycle Scheme

Special Time Off

Family Planning

Job summary

NCC Group in Manchester is seeking a hands-on Threat Hunter to join the Cyber Services and Capabilities team. You will proactively hunt, analyse advanced threats across customer environments using our proprietary framework, and ensure threat models align to client needs.

The role involves hypothesis-driven analysis, collaboration with SOC, detection engineers, and engineering teams to improve visibility and detections in hybrid and cloud environments.

Qualifications

• Experience in threat hunting and incident response.
• Strong knowledge of the MITRE ATT&CK framework.
• Experience with SIEM/EDR tooling and detection engineering.
• Ability to present findings to stakeholders.
• Autonomous worker in fast-moving environments.

Responsibilities

• Hunt for threats using HITS framework and MITRE ATT&CK.
• Automate hunts, visualise results, create reusable artifacts.
• Collaborate with detection engineering to operationalise detections.
• Utilise internal and external threat intel to surface detections.
• Map threat models to monitoring use cases with teams.
• Document methodologies and maintain hunting repository.
• Provide regular reports and stakeholder presentations.

Skills

Hypothesis-driven hunting

MITRE ATT&CK

Threat hunting

Cross-functional collaboration

Python / KQL

Tools

GitLab

Sigma

Jupyter Notebooks

Splunk

Microsoft Defender

SentinelOne

CrowdStrike

Job description

NCC Group in Manchester is seeking a hands-on Threat Hunter to join the Cyber Services and Capabilities team. You will proactively hunt, analyse advanced threats across customer environments using our proprietary framework, and ensure threat models align to client needs.

The role involves hypothesis-driven analysis, collaboration with SOC, detection engineers, and engineering teams to improve visibility and detections in hybrid and cloud environments.