Senior Agentic Threat Hunt Specialist

NN Group; Netherlands; Hybrid; EUR 110,000 - 150,000; Full time

Job summary

NN Group is seeking a Senior Agentic Threat Hunting Specialist to design and build AI-driven agents and multi-agent workflows for threat hunting and threat intelligence. This is an AI and engineering role applied to cyber defence, not a traditional Threat Hunter.

You will translate hunting methods and analyst decision-making into practical capabilities that analysts can trust. You will connect agents to SIEM, XDR and other security tools, ensure outputs are explainable and evidence-based, and

Qualifications

• Hands-on experience building solutions with generative AI, large language models and AI agents.
• Understanding of agentic patterns, orchestration, tool calling, prompt and context engineering, memory, RAG, embeddings and vector search.
• Practical software engineering skills, preferably Python, including API integrations, workflow automation and working with structured and unstructured data.
• Experience evaluating LLM or agent behaviour, including output quality, reliability, security, observability and failure handling.
• Ability to move from experimentation and prototypes to robust capabilities that other teams can use.

Responsibilities

• Design our agentic architecture and workflows from scratch for threat hunting and threat intelligence use cases.
• Build and orchestrate autonomous and semi-autonomous AI agents, including multi-agent workflows that support investigation, enrichment, reasoning and decision-making.
• Develop LLM-based applications using tool calling, APIs, retrieval-augmented generation, context engineering, memory and knowledge repositories.
• Connect agents to security tools and data sources across SIEM, XDR, EDR, Threat Intelligence and Vulnerability Management platforms.
• Create guardrails, validation mechanisms and human-in-the-loop controls so that agent outputs are explainable, secure and supported by evidence.
• Evaluate agent quality, reliability and usefulness, identify failure modes and continuously improve prompts, workflows, tools and models.

Skills

AI engineering

LLMs & agents

Software engineering

Prompt engineering

Workflow orchestration

Security knowledge

Education

Technical university degree

Tools

Python

APIs

Vector search

Job description

Build the AI agents that will change how threat hunting is done.

More security data does not automatically mean better security. We need intelligent systems that can reason over it, connect evidence and help analysts investigate faster and at scale.

At NN, we are looking for a Senior Agentic Threat Hunting Specialist to design and build AI-driven agents and multi-agent workflows for threat hunting and threat intelligence. This is not a traditional Threat Hunter role with AI added on top. It is primarily an AI and engineering role applied to cyber defence.

Your focus will be on agentic AI, LLM-based applications and workflow orchestration. You will work with experienced security specialists to translate hunting methods, investigation logic and analyst decision-making into practical capabilities that analysts can trust and use.

What you'll actually do

Agentic AI and engineering

• Design our agentic architecture and workflows from scratch for threat hunting and threat intelligence use cases.
• Build and orchestrate autonomous and semi-autonomous AI agents, including multi-agent workflows that support investigation, enrichment, reasoning and decision-making.
• Develop LLM-based applications using tool calling, APIs, retrieval-augmented generation, context engineering, memory and knowledge repositories.
• Connect agents to security tools and data sources across SIEM, XDR, EDR, Threat Intelligence and Vulnerability Management platforms.
• Create guardrails, validation mechanisms and human-in-the-loop controls so that agent outputs are explainable, secure and supported by evidence.
• Evaluate agent quality, reliability and usefulness, identify failure modes and continuously improve prompts, workflows, tools and models. Validate agent generated findings and confirm that conclusions are supported by evidence.
• Explore emerging AI models, frameworks and orchestration patterns, then turn the promising ones into maintainable capabilities for day-to-day cyber defence.
• Translate hunting hypotheses, MITRE ATT&CK techniques and analysts' decision-making processes into reusable agentic workflows and playbooks.
• Use security telemetry and threat intelligence to test agents against realistic investigation and hunting scenarios. Contribute to selected hands-on hunts where they help develop, test or improve the agentic capabilities.

The goal is practical: AI capabilities that improve investigations, strengthen threat hunting and reduce repetitive analytical work.

Why you'll like working here

• Meaningful work: Help shape how agentic AI is used in a real enterprise cyber defence environment.
• Hybrid and flexible: Enjoy a strong home-office culture, flexible time off and a hybrid setup. Most of the time you can work from home, with the team meeting in the office once a week. There is also a monthly contribution towards home-office expenses.
• Time to recharge: Enjoy Flexi Time Off and take paid holiday beyond the usual allowance with your manager's approval.
• Support for your growth: Professional training tailored to your development.
• Benefits that add up: Meal allowance, up to CZK 20,000 a year in the Cafeteria, the option of a MultiSport card, pension contributions and a discount on life insurance.
• The tools you need: A company laptop and iPhone with a paid O2 tariff and data package.
• Referral bonus: Up to CZK 60,000 for recommending a suitable new colleague.

What we're looking for

We are looking primarily for an AI and agentic systems specialist who can apply their expertise to cybersecurity. Deep threat hunting expertise is valuable, but it is not the main requirement for this role.

Your core strengths

• Hands-on experience building solutions with generative AI, large language models and AI agents.
• Understanding of agentic patterns, orchestration, tool calling, prompt and context engineering, memory, RAG, embeddings and vector search.
• Practical software engineering skills, preferably Python, including API integrations, workflow automation and working with structured and unstructured data.
• Experience evaluating LLM or agent behaviour, including output quality, reliability, security, observability and failure handling.
• Ability to move from experimentation and prototypes to robust capabilities that other teams can use.
• Curiosity and confidence working in a fast-moving technical field where established patterns are still evolving.

Cybersecurity knowledge

• Good understanding of threat hunting, threat intelligence, attacker behaviours and hypothesis-driven investigations.
• Familiarity with MITRE ATT&CK, incident investigation, detection engineering and common security telemetry.
• Experience with SIEM, XDR or EDR platforms is beneficial; experience with Microsoft Sentinel or Splunk is an advantage.
• Ability to work with security specialists and translate domain expertise into technical AI workflows.
• Around 2-5 years of relevant experience in AI engineering, software engineering, cybersecurity automation, threat hunting or a related field.
• A university degree in a technical field is welcome, but demonstrable hands-on expertise matters most.
• English at C1 level, so you can collaborate confidently across teams.