Threat Hunter: Proactive Cyber Defense

Kroll, LLC.; Manila; On-site; PHP 1,200,000 - 2,400,000; Full time

Job summary

Kroll is seeking a Threat Hunter in Manila to proactively detect advanced cyber threats and improve SOC capabilities. You will formulate hypotheses from threat intelligence and run analytics across logs, networks, and endpoints to reveal hidden adversaries.

The role requires 5+ years of cybersecurity experience, proficiency with CrowdStrike, Splunk, Wireshark, YARA, and Python, and knowledge of MITRE ATT&CK. Strong communication and teamwork are essential.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related field.
• Advanced certifications like GCTI, CTIA, or OSCP preferred.
• 5+ years in cybersecurity with hands-on experience in SOC, IR, and threat hunting.
• Proficiency with CrowdStrike Falcon, Splunk, Wireshark, YARA, and Python for scripting/automation.
• Strong analytical skills and knowledge of MITRE ATT&CK framework.

Responsibilities

• Develop and test hypotheses from threat intel, anomalies, and attack patterns to hunt for malicious activity.
• Analyze logs, network traffic, endpoints, and telemetry using SIEM/EDR and custom scripts to detect stealthy attacks.
• Document findings, create repeatable hunt playbooks, and collaborate with detection engineering to automate responses.
• Research emerging threats, malware, and TTPs; generate reports and mitigations.
• Conduct threat hunting campaigns, assess vulnerabilities, and support incident response while refining tools and processes.

Skills

Threat hunting

Incident response

Analytical skills

MITRE ATT&CK

Education

Bachelor's degree in Cybersecurity/CS

Advanced security certifications (GCTI/CTIA/OSCP)

Tools

CrowdStrike Falcon

Splunk

Wireshark

YARA

Python scripting

Job description

Kroll is seeking a Threat Hunter in Manila to proactively detect advanced cyber threats and improve SOC capabilities. You will formulate hypotheses from threat intelligence and run analytics across logs, networks, and endpoints to reveal hidden adversaries.

The role requires 5+ years of cybersecurity experience, proficiency with CrowdStrike, Splunk, Wireshark, YARA, and Python, and knowledge of MITRE ATT&CK. Strong communication and teamwork are essential.