Hypothesis-Driven Threat Hunter & Detection Engineer

Jobvite, Inc.; United States; Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Hybrid remote work

Medical, dental, and vision insurance

401(k) plan

Unlimited PTO

Growth opportunities

Job summary

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry, turning findings into durable detections and SOP guidance for deployment by the tooling team.

You will work at the intersection of threat intelligence, detection engineering, and offensive validation, translating red-team findings into actionable detection content while collaborating with the SOC and red

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response with hands-on threat-hunting responsibility.
• Experience running hypothesis-driven hunts using intel and telemetry.
• Strong working knowledge of adversary TTPs and MITRE ATT&CK framework.
• Proficiency querying telemetry at scale in SIEM/EDR/XDR (e.g., KQL, SPL).

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Consume CTI and red-team findings to prioritize hunts by adversary behaviors.
• Map hunts to MITRE ATT&CK to track coverage and expose gaps.
• Translate hunt findings into detection logic and SOP guidance for tooling team.
• Partner with red team on purple validation of configuration faults.
• Surface and drive remediation for configuration faults and posture gaps.
• Document hypotheses, methods, and outcomes for reusable artifacts.
• Contribute threat context during Sev 1 incidents in advisory capacity.
• Other duties as needed

Skills

Adversary mindset

Patience & persistence

Data pivoting

Detection engineering

Documentation

Communication

Job description

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry, turning findings into durable detections and SOP guidance for deployment by the tooling team.

You will work at the intersection of threat intelligence, detection engineering, and offensive validation, translating red-team findings into actionable detection content while collaborating with the SOC and red