Hypothesis-Driven Threat Hunter (Remote)

NinjaOne; California; Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne seeks a Threat Hunter to join its Cyber Threat Intelligence function and run proactive, hypothesis-driven hunts across our environment. This role sits at the front of a detection pipeline, turning intelligence into concrete hunts and delivering detection packages for tooling and SOC consumption.

You’ll work at the intersection of threat intel, detection engineering, and offensive validation, hunting for evasive activity and misconfigurations, and feeding durable detections back into the

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response with hands-on threat-hunting.
• Experience running hypothesis-driven hunts and turning telemetry into conclusions.
• Strong knowledge of adversary TTPs and MITRE ATT&CK.
• Proficiency querying across telemetry in SIEM/EDR/XDR (KQL, SPL).

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Translate hunt findings into detection packages and SOP guidance.
• Map hunts to MITRE ATT&CK to track coverage.
• Collaborate with red team for validation of configuration faults and posture gaps.
• Document hypotheses, methods, and outcomes for reusable artifacts.

Skills

Threat hunting

MITRE ATT&CK

SIEM/EDR/XDR

Threat intelligence

KQL

SPL

Threat modeling

Education

Bachelor's degree in CS/InfoSec

Tools

SIEM

EDR/XDR

TIP platform

Job description

NinjaOne seeks a Threat Hunter to join its Cyber Threat Intelligence function and run proactive, hypothesis-driven hunts across our environment. This role sits at the front of a detection pipeline, turning intelligence into concrete hunts and delivering detection packages for tooling and SOC consumption.

You’ll work at the intersection of threat intel, detection engineering, and offensive validation, hunting for evasive activity and misconfigurations, and feeding durable detections back into the