Advanced Threat Hunting

PwC India; Mumbai; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

PwC India is seeking an experienced threat hunter to develop and execute hypothesis-driven campaigns across enterprise infrastructure. You will design MITRE ATT&CK-aligned frameworks and translate threat intel into actionable detections and runbooks.

The role requires hands-on expertise in threat hunting, log and network forensics, and mentoring SOC analysts. Collaboration with SOC, IR, and TI teams is essential to success.

Qualifications

• Hands-on experience in advanced threat hunting and incident response.
• Proven expertise in hypothesis-driven threat hunting methodologies.
• Strong understanding of MITRE ATT&CK framework and threat actor TTPs.
• Advanced proficiency with threat hunting tools like Splunk, Elasticsearch, Wireshark, Zeek, osquery.
• Deep knowledge of Windows, Linux, and network forensics.
• Experience with log analysis, packet analysis, and endpoint artifacts.

Responsibilities

• Develop hypothesis-driven threat hunting campaigns across enterprise infrastructure.
• Design threat hunting frameworks aligned with MITRE ATT&CK methodology.
• Conduct deep forensic analysis using logs, network traffic, and system artifacts.
• Build detection queries and signatures for identified threats and TTPs.
• Collaborate with SOC, incident response, and threat intelligence teams.
• Create threat hunting runbooks and operationalize findings.
• Mentor SOC analysts on advanced hunting techniques and methodologies.
• Deliver insights and recommendations to stakeholders.

Skills

Threat hunting

Incident response

MITRE ATT&CK knowledge

Log analysis

Forensics

Analytical thinking

Scripting (Python/PowerShell)

Tools

Splunk

Elasticsearch

Wireshark

Zeek

osquery

Job description

Key Responsibilities

• Develop and execute hypothesis-driven threat hunting campaigns across enterprise infrastructure
• Design threat hunting frameworks aligned with MITRE ATT&CK methodology
• Formulate actionable hypotheses based on threat intelligence and attack vectors
• Conduct deep forensic analysis using logs, network traffic, and system artifacts
• Build detection queries and signatures for identified threats and TTPs (Tactics, Techniques, Procedures)
• Collaborate with SOC, incident response, and threat intelligence teams
• Create threat hunting runbooks and operationalize hunting findings
• Analyze and profile attacker behaviors, attack chains, and persistence mechanisms
• Deliver threat hunting insights and recommendations to stakeholders and leadership
• Mentor and train SOC analysts on advanced hunting techniques and methodologies
• Participate in incident investigations requiring specialized hunting skills
• Maintain and update threat models based on emerging threats and industry trends

Required Qualifications

• 3-7 years of hands-on experience in advanced threat hunting and incident response
• Proven expertise in hypothesis-driven threat hunting methodologies
• Strong understanding of MITRE ATT&CK framework and threat actor TTPs
• Advanced proficiency with threat hunting tools (Splunk, Elasticsearch, Wireshark, Zeek, osquery)
• Deep knowledge of Windows, Linux, and network-level forensics
• Experience with log analysis, packet analysis, and endpoint artifacts
• Understanding of attack chains, lateral movement, and data exfiltration techniques
• Proficiency in query languages (SPL, KQL, YARA rules, regular expressions)
• Strong analytical and investigative skills with attention to detail

Desired Skills

• GIAC Certified Incident Handler (GCIH) or GIAC Certified Intrusion Analyst (GCIA)
• Certified Threat Intelligence Professional (CTIP) or equivalent
• Scripting proficiency (Python, PowerShell, Bash) for data processing and automation
• Experience with threat intelligence platforms and frameworks
• Knowledge of C2 frameworks, malware analysis, and reverse engineering
• Hands-on experience with EDR platforms (CrowdStrike, Carbon Black, Defender)
• Cloud infrastructure security hunting (AWS, Azure, GCP)
• Threat modeling and risk assessment expertise