Thread Hunting

Tata Consultancy Services Limited; Hyderabad; On-site; INR 1,500,000 - 4,000,000; Full time

Job summary

Tata Consultancy Services Limited is seeking a Threat Hunting expert in Hyderabad with 5+ years of experience. You will design hypothesis-driven hunts across endpoints, networks, and cloud telemetry, and analyze SIEM/EDR logs to detect and respond to threats.

The role requires strong knowledge of MITRE ATT&CK, command-and-control activities, and collaboration with SOC and IR teams to strengthen detection capabilities.

Qualifications

• Experience in threat hunting, threat intelligence, incident response, and SIEM detection engineering.
• Knowledge of MITRE ATT&CK and cyber kill chain concepts.
• Hands-on experience with EDR/XDR platforms and SIEM tooling.

Responsibilities

• Design and execute hypothesis-driven hunts across endpoints, identity, network, email, SaaS and cloud telemetry.
• Analyze logs from SIEM, EDR/XDR, network, cloud, and identity sources to identify suspicious activity.
• Develop detection rules and automation to improve threat detection and response.
• Collaborate with SOC analysts, Incident Response, Detection Engineering, and Threat Intelligence teams.
• Document findings, root cause, and remediation recommendations.
• Support incident response during active security incidents.

Skills

Threat hunting

Incident response

Forensic analysis

Python scripting

PowerShell scripting

Threat intelligence

MITRE ATT&CK

KQL / SPL / LogScale

EDR/XDR

SIEM expertise

Tools

CrowdStrike Falcon

Microsoft Defender

SentinelOne

Splunk

Microsoft Sentinel

CrowdStrike NG SIEM

QRadar

Elastic

LogScale (CQL)

Job description

Role:Threat Hunting

Experience:5+ Years

Location: Hyderabad

Mode of Interview: Virtual

Job Description (JD):

• Design and execute hypothesis-driven and IOC intelligence-led hunts across endpoint, identity, network, email, SaaS and cloud telemetry.
• Experience in threat hunting, threat intelligence, incident response, and SIEM detection engineering.
• Develop threat hunting hypotheses based on current threat intelligence and frameworks such as MITRE ATT&CK.
• Analyze logs from SIEM, EDR/XDR, network, cloud, and identity sources.
  Investigate suspicious behaviors, anomalous user activity, and potential indicators of compromise (IOCs).
• Perform malware triage and behavioral analysis when required.
• Identify attacker persistence mechanisms, privilege escalation, lateral movement, and command-and-control (C2) activity.
• Create and optimize detection rules, correlation logic, and behavioral analytics.
  Collaborate with SOC analysts, Incident Response, Detection Engineering, Vulnerability Management, and Threat Intelligence teams.
• Develop new hunting queries and automation to improve threat detection.
  Validate security controls and identify detection gaps.
• Document findings, root cause, recommendations, and lessons learned.
  Support incident response during active security incidents.
• Track emerging threats, zero-day vulnerabilities, and adversary campaigns.
• Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence, credential misuse and stealthy command-and-control activity.
• Demonstrated ability to write detection logic in at least one enterprise SIEM or XDR platform e.g. CrowdStrike NG-SIEM (LogScale/CQL).
• Hands-on EDR analysis, behavioural anomaly detection and investigation of post-exploitation activity.
• Strong Windows internals and Linux fundamentals: process ancestry, LOLBins, registry and service persistence, WMI, PowerShell abuse, credential theft.
• Scripting in Python and/or PowerShell for automation, log parsing and investigative tooling.
• Dark web monitoring for leaked credentials, lookalike phishing websites, and internal data
• Digital risk protection platforms: ZeroFox, Rapid 7 Insights, Flashpoint, Intel471

Required Skills

• Strong understanding of the Cyber Kill Chain and MITRE ATT&CK.
• Knowledge of Windows, Linux, macOS, and Active Directory security.
• Experience with EDR/XDR platforms (such as CrowdStrike Falcon, Microsoft Defender, SentinelOne).
• Experience with SIEM platforms (Splunk, Microsoft Sentinel, CrowdStrike NG SIEM, QRadar, Elastic, etc.).
• Knowledge of network protocols (DNS, HTTP/S, SMB, LDAP, RDP, SSH, Kerberos).
• Experience analyzing Windows Event Logs, Sysmon, PowerShell, and authentication logs.
• Ability to create hunting queries using KQL, SPL, SQL, LogScale, or similar query languages.
• Familiarity with IOC, IOA, YARA, Sigma, and detection engineering.
• Basic malware analysis and forensic investigation skills.
• Scripting experience in Python or PowerShell is preferred.
• Understanding of cloud security (AWS, Azure, GCP).