Security Threat Hunting Specialist

wpp; India; Hybrid; INR 900,000 - 1,500,000; Full time

Job summary

WPP is seeking a Threat Hunter to proactively identify advanced threats that bypass traditional security controls. You will perform hypothesis-driven investigations, leverage threat intelligence and analyze telemetry across endpoints, networks and cloud to uncover stealthy adversary activity.

You will collaborate with SOC, IR and engineering teams to improve detection coverage, automate hunting workflows and reduce dwell time within a transformational Autonomic Security Operations model.

Qualifications

• Proven experience in threat hunting using MITRE ATT&CK and TaHiTI.
• Strong SIEM/EDR/XDR skills across hybrid environments.
• Scripting skills (Python, PowerShell) for automation.
• Familiarity with threat intelligence integration and behavioral analytics.
• Excellent collaboration with SOC, IR and engineering teams.

Responsibilities

• Execute hypothesis-driven threat hunts based on adversary TTPs and threat intelligence.
• Analyze telemetry from SIEM, EDR/XDR, NDR and cloud platforms to identify anomalies.
• Develop and maintain hunting queries and automation scripts for repeatability.
• Document hunt findings and feed insights into detection engineering and SOC workflows.

Skills

Threat hunting

MITRE ATT&CK

SIEM

EDR/XDR

Python

PowerShell

Education

GIAC GCTI

GIAC GCIH

Tools

NDR

SOAR

Job description

WPP is the trusted growth partner for the world's leading brands.

We unite cutting-edge media intelligence and data solutions, world-class creativity, next-generation production, transformative enterprise solutions and expert strategic counsel in a single company - powered by exceptional talent and our agentic marketing platform, WPP Open, to help our clients navigate change, capture opportunity and deliver transformational growth.

We work with the world's most valuable brands and have global reach across 100+ markets, with deep local expertise.

Our people are the key to our success. We're committed to fostering a culture of creativity, belonging and continuous learning, attracting and developing the brightest talent, and providing exciting career opportunities that help our people grow.

For more information, visit WPP.com.

Why we’re hiring:

The Threat Hunter is responsible for proactively identifying advanced threats that evade traditional security controls. This role involves hypothesis-driven investigations, leveraging threat intelligence, and analyzing telemetry across endpoints, networks, and cloud environments to uncover stealthy adversary activity. The Threat Hunter plays a critical role in reducing dwell time and strengthening organizational resilience under the Autonomic Security Operations model.

What you’ll be doing:

Proactive Threat Hunting

• Execute hypothesis-driven hunts based on adversary TTPs and threat intelligence.
• Analyze telemetry from SIEM, EDR/XDR, NDR, and cloud-native platforms to identify anomalies.
• Develop and maintain hunting queries and scripts for automation and repeatability.
• Validate detection coverage through purple team exercises and adversary emulation.

Threat Intelligence Integration

• Incorporate emerging threat intelligence into hunting hypotheses and detection pipelines.
• Maintain awareness of global threat actor tactics, techniques, and procedures (MITRE ATT&CK).

Continuous Improvement

• Document hunt findings and feed insights into detection engineering and SOC workflows.
• Maintain a backlog of hunting hypotheses and visibility gaps for remediation.
• Contribute to automation of hunting workflows using scripting and SOAR platforms.

Strategic Alignment to GCAT SOC10x

• 10X People: Continuous learning and knowledge sharing within the team.
• 10X Process: Embed agile, hypothesis-driven hunting workflows.
• 10X Technology: Leverage AI/ML analytics for anomaly detection and hunt acceleration.
• 10X Visibility: Ensure comprehensive telemetry ingestion across hybrid environments.
• 10X Speed: Reduce dwell time and accelerate detection-to-response cycles.

What you’ll need:

Technical Expertise

• Strong knowledge of threat hunting methodologies and frameworks (MITRE ATT&CK, TaHiTI).
• Proficiency in SIEM, EDR/XDR, and log aggregation tools across hybrid infrastructure.
• Scripting skills (Python, PowerShell) for automation and data analysis.
• Familiarity with threat intelligence integration and behavioral analytics.

Collaboration & Communication

• Ability to work closely with SOC, IR, and engineering teams.
• Skilled in documenting hunt outcomes and communicating findings effectively.

Certifications (Preferred)

• GIAC GCTI, GCIH, or equivalent advanced security certifications.

Key Attributes

• Automation-first mindset with focus on scalability and resilience.
• Strong analytical and problem-solving skills.
• Excellent communication and teamwork capabilities.

Who you are:

You’re open : We are inclusive and collaborative; we encourage the free exchange of ideas; we respect and celebrate diverse views. We are open-minded: to new ideas, new partnerships, new ways of working.

You’re optimistic : We believe in the power of creativity, technology and talent to create brighter futures or our people, our clients and our communities. We approach all that we do with conviction: to try the new and to seek the unexpected.

You’re extraordinary: we are stronger together: through collaboration we achieve the amazing. We are creative leaders and pioneers of our industry; we provide extraordinary every day.

What we’ll give you:

• Passionate, inspired people - We aim to create a culture in which people can do extraordinary work.
• Scale and opportunity - We offer the opportunity to create, influence and complete projects at a scale that is unparalleled in the industry.
• Challenging and stimulating work - Unique work and the opportunity to join a group of creative problem solvers. Are you up for the challenge?

#LI-Hybrid

We believe the best work happens when we’re together, fostering creativity, collaboration, and connection. That’s why we’ve adopted a hybrid approach, with teams in the office around four days a week. If you require accommodations or flexibility, please discuss this with the hiring team during the interview process.

WPP is an equal opportunity employer and considers applicants for all positions without discrimination or regard to particular characteristics. We are committe