Senior Information Security Analyst (Threat Hunting)

Eurofins; India; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Eurofins Scientific is seeking a Senior Information Security Analyst (Threat Hunting) to lead proactive detection across endpoints, networks, identities and cloud environments. The role focuses on hypothesis-driven hunting, telemetry analysis, and turning weak signals into actionable security insights.

You will collaborate with detection engineering, SOC, IR, red team, and threat intel teams to close detection gaps and improve Eurofins' security posture.

Qualifications

• BE / B.Tech / MCA or equivalent degree.
• 4+ years in cybersecurity roles such as SOC, threat hunting, detection engineering or IR.
• Experience with large-scale security telemetry and investigative analysis.
• Certifications (GCFE/GCIA/GCFA) are a plus but not mandatory.

Responsibilities

• Conduct hypothesis-driven threat hunting across endpoint, network, identity, cloud, and application telemetry.
• Develop and execute hunt scenarios based on threat intel and MITRE ATT&CK techniques.
• Analyze SIEM/EDR/NDR and cloud logs to uncover anomalies and malicious activity.
• Identify detection gaps and work with detection engineering to improve rules and alerts.
• Investigate low-fidelity signals that may indicate attacker presence.
• Automate hunts and data enrichment with scripting to speed analysis.
• Collaborate with IR, SOC, red team, and threat intel teams during investigations.
• Document methodologies, findings, and lessons in a repeatable manner.
• Continuously research emerging threats and attacker behaviors relevant to Eurofins.

Skills

Threat hunting methods

MITRE ATT&CK knowledge

Windows internals

Linux systems

Network log analysis

Scripting (Python, PowerShell, Bash)

Detection engineering collaboration

Education

BE / B.Tech / MCA or equivalent

Tools

Splunk

Elastic / ELK

QRadar

KQL

SPL

Lucene

SQL-like queries

Microsoft Defender

CrowdStrike

SentinelOne

Job description

Senior Information Security Analyst (Threat Hunting)

• Full-time

Eurofins Scientific is an international life sciences company, providing a unique range of analytical testing services to clients across multiple industries, to make life and our environment safer, healthier and more sustainable. From the food you eat, to the water you drink, to the medicines you rely on, Eurofins works with the biggest companies in the world to ensure the products they supply are safe, their ingredients are authentic and labelling is accurate. Eurofins believes it is a global leader in food, environmental, pharmaceutical and cosmetics products testing and in agroscience CRO services. It is also one of the global independent market leaders in certain testing and laboratory services for genomics, discovery pharmacology, forensics, CDMO, advanced material sciences and in the support of clinical studies.

In over just 30 years, Eurofins has grown from one laboratory in Nantes, France to over 62,000 staff across a network of more than 1000 independent companies in over 62 countries and operating more than 900 laboratories. Eurofins offers a portfolio of over 200,000 analytical methods to evaluate the safety, identity, composition, authenticity, origin, traceability and purity of biological substances and products, as well as providing innovative clinical diagnostic testing services, as one of the leading global emerging players in specialised clinical diagnostics testing.

In 2022, Eurofins generated total revenues of EUR € 6.515billion, and has been among the best performing stocks in Europe over the past 20 years.

As part of the Threat Hunting function within Eurofins Information Security, you will lead proactive detection of advanced threats by actively searching for adversaries that evade traditional security controls. This role goes beyond alert-driven SOC work, focusing on hypothesis-driven hunting, deep telemetry analysis, and uncovering stealthy attacker behaviour across endpoints, networks, identities, and cloud environments.

You will combine strong technical expertise, attacker tradecraft knowledge, and analytical thinking to identify unknown threats, validate detection gaps, and improve Eurofins' overall detection and response posture. This is a hands-on technical role for professionals who enjoy diving deep into data, thinking like an adversary, and turning weak signals into actionable security insights.

POSITION & OBJECTIVES:

• Conduct proactive, hypothesis-driven threat hunting across endpoint, network, identity, cloud, and application telemetry
• Develop and execute hunt scenarios based on threat intelligence, MITRE ATT&CK techniques, and emerging adversary TTPs
• Analyze large datasets from SIEM, EDR/XDR, NDR, identity platforms, and cloud logs to uncover anomalous or malicious activity
• Identify detection gaps and collaborate with detection engineering teams to create or improve rules, analytics, and alerts
• Investigate low-fidelity or weak signals that fall below traditional alert thresholds but may indicate attacker presence
• Leverage scripting and automation to accelerate hunts, data enrichment, and large-scale analysis
• Collaborate with incident response teams during active investigations to provide deep technical analysis and attacker context
• Validate and refine hypotheses through iterative testing, purple team exercises, and adversary emulation activities
• Translate hunt findings into actionable outcomes: new detections, improved telemetry coverage, and documented attacker behaviors
• Document hunt methodologies, findings, assumptions, and lessons learned in a structured and repeatable manner
• Continuously research emerging threats, tools, techniques, and attack campaigns relevant to Eurofins' environment.

Technical Knowledge:

• Strong understanding of threat hunting methodologies (hypothesis-driven, data-driven, intelligence-led hunting)
• Deep knowledge of attacker TTPs and the MITRE ATT&CK framework across multiple platforms (Windows, Linux, cloud, identity)
• Hands-on experience with SIEM platforms (e.g., Splunk, Elastic, QRadar) and advanced query languages (KQL, SPL, Lucene, SQL-like queries)
• Strong experience with EDR/XDR platforms (e.g., Microsoft Defender, CrowdStrike, SentinelOne) and endpoint telemetry analysis
• Solid understanding of Windows internals, Linux systems, Active Directory, authentication flows, and identity attacks
• Experience analyzing network traffic, DNS, proxy, firewall, and cloud control plane logs
• Familiarity with cloud attack techniques (Azure/AWS/GCP), SaaS abuse, and identity-based attacks
• Ability to correlate telemetry across multiple data sources to reconstruct attacker timelines
• Scripting and automation skills in Python, PowerShell, or Bash for hunting and data analysis
• Experience working closely with detection engineering, SOC, IR, red team, and threat intelligence functions

Personal Qualities:

• Excellent verbal and written communication skills (concise writing and oral convincing)
• Eager to learn and continuously develop personal and technical capabilities.
• Proactive and self-driven, comfortable operating with minimal direction.
• Excellent interpersonal, analytical, detail-oriented, and problem-solving skills.
• Proactive personality who can adapt to changing priorities and a keen analytical mindset to investigate cases.
• Good team player with ability to work with team spread across the world.

QUALIFICATIONS AND EXPERIENCE REQUIRED:

• BE / B. Tech / MCA or equivalent degree
• 4+ years of hands-on experience in cybersecurity roles such as SOC, threat hunting, detection engineering, or incident response
• Proven experience working with large-scale security telemetry and investigative analysis
• Certifications (e.g., GCFE, GCIA, GCFA) are a plus but not mandatory if strong practical experience is demonstrated