Threat Hunter

Tecplix Technologies; Bengaluru; In loco; INR 900.000 - 1.500.000; Tempo pieno

Descrizione del lavoro

Tecplix Technologies is seeking a skilled Threat Hunter to proactively hunt across endpoints, network, cloud, and identity telemetry. You will partner with SOC, IR, CTI, and Detection Engineering to develop detections, drive containment, and improve visibility and signal fidelity.

You will work with Google SecOps, CrowdStrike NG-SIEM, and common EDR/XDR tools, translating hunt results into practical use-cases, enrichments, and runbooks, while contributing to tabletop exercises and weekly trend

Competenze

• 3–4 years in Threat Hunting/SOC/IR with measurable outcomes in proactive hunts and detection creation.
• Strong command of MITRE ATT&CK, kill chain, adversary emulation, and hypothesis-driven hunting.
• Solid foundation in networking and operating systems (Windows/Linux) with security implications.
• Proficiency with Python/PowerShell and data querying (UDM, SPL, KQL).
• Experience with SIEMs and EDR/XDR tooling.

Mansioni

• Formulate and test hypotheses using attacker TTPs, CTI signals, analytics, and baselines across endpoints, identity, DNS/Proxy, and cloud logs.
• Perform structured hunts using queries and EDR telemetry; document approach, evidence, and conclusions.
• Translate hunt outcomes into detections/use-cases (UDM rules, Sigma); publish runbooks and guidance.
• Propose SOAR playbooks for repetitive triage and containment workflows.
• Conduct full digital forensics on hosts and networks; analyze artifacts.
• Lead deep-dive triage of stealthy detections; root-cause analysis and eradication recommendations.
• Collaborate with IR to validate containment actions and post-incident tasks.
• Identify telemetry gaps; advocate for new log sources and enrichment.
• Track detection efficiency and false positives; improve precision and recall.

Conoscenze

Threat hunting

SOC/IR experience

MITRE ATT&CK

Networking basics

Scripting

Strumenti

Google SecOps

CrowdStrike

Splunk

Sumo Logic

UDM rules

Sigma

YARA

Descrizione del lavoro

Role Summary

You will execute proactive hunts across endpoint, network, cloud, identity, and SaaS telemetry to uncover stealthy threats that bypass preventive controls. Partnering closely with SOC (L1/L2), Incident Response (IR), Threat Intelligence (CTI), and Detection Engineering, youll formulate hunting hypotheses, develop detections, and drive rapid containment while continuously improving our visibility and signal fidelity.

Primary platforms:

Google SecOps, CrowdStrike NG-SIEM, plus leading EDR/XDR tools (CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black).

Responsibilities

• Formulate and test hypotheses using attacker TTPs, CTI signals, behavioural analytics, and anomaly baselines; pivot across endpoint events, identity signals, DNS/Proxy, Firewall, Email security, and cloud logs.
• Perform structured hunts using queries, Sigmastyle logic, and EDR telemetry; document approach, evidence, and conclusions.
• Translate hunt outcomes into detections/usecases (UDM rules, Sigma), enrich with TI, and calibrate thresholds; publish runbooks and suppression guidance.
• Propose and collaborate on SOAR playbooks for repetitive triage and containment workflows (e.g., isolate host, disable account, revoke refresh tokens).
• Conduct full digital forensics investigations on host systems and network infrastructures.
• Analyse digital evidence, perform memory, disk, and network forensics, and extract artefacts to understand the nature of security incidents.
• Perform malware analysis using both static and dynamic techniques to determine functionality, persistence mechanisms, and potential impact on systems.
• Lead deepdive triage of stealthy detections: inspect processes, memory artifacts, PowerShell, WMI, scheduled tasks, registry, lateral movement paths; perform rootcause analysis and recommend eradication measures.
• Partner with IR to validate containment actions, confirm eradication, and capture postincident huntback tasks.
• Identify telemetry gaps; advocate new log sources, sensor policy changes, and enrichment (TI feeds, asset context).
• Track detection efficiency and falsepositive drivers; iterate content to improve precision & recall.
• Contribute to tabletop exercises/purple teaming alongside offensive security to validate defenses and hunt readiness.
• Produce weekly hunt summaries, monthly trend reports, and executive dashboards; maintain evidence repositories and knowledge articles for reuse by SOC analysts.

MustHave Qualifications

• Experience: 3-4 years in Threat Hunting/SOC/IR with measurable outcomes in proactive hunts and detection creation.
• Frameworks & Tradecraft: Strong command of MITRE ATT\&CK, kill chain, adversary emulation, and hypothesisdriven hunting.
• Networking & OS: Solid foundation in networking protocols and operating systems (Windows/Linux) with understanding of security implications.
• Platforms & Tools:
• SIEM: Google SecOps, CrowdStrike, Splunk, Sumo Logic; comfort with UDM and query development.
• EDR/XDR: CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black.
• Detection Content: Sigma rules; familiarity with YARA for artifacts/malware indicators.
• Scripting & Querying: Proficiency with Python/PowerShell and data querying (UDM, SPL, KQL or equivalent).
• Cloud & Identity: Working knowledge of Azure/AWS logging, IAM signals, and SaaS telemetry mapping.
• Communication: Crisp written and verbal skills; ability to brief both engineers and executives.

GoodtoHave

• Experience with purple teaming, adversary emulation, and memory forensics; exposure to malware behaviour analysis.
• Prior work in regulated industries (BFSI, Telecom, Healthcare, Manufacturing) with compliance-aware operations.
• Certifications: GCFA, GCIH, CTIA, Threat Hunting Specialist, Azure Security (SC200/SC300) or equivalent.

KPIs & Performance Metrics

• Hunt Cadence & Yield: Hunts executed per month; new detections per quarter mapped to ATT\&CK.
• Signal Quality: Truepositive rate, falsepositive reduction trend; MTTD/MTTR contribution deltas post tuning.
• Coverage & Gaps: % of priority ATT\&CK techniques covered; number of closed visibility gaps (new sources/enrichments).
• Automation Impact: Playbooks created/enhanced; average manual steps removed per workflow.
• Operational Hygiene: Completeness of documentation/runbooks; ontime delivery of weekly/monthly reports.