Lead Threat Hunter: AI-Driven Security Analytics

Remote Source, Inc.; United States; Remote; USD 120,000 - 175,000; Full time

Job summary

Allstate is seeking a Lead Threat Hunter to direct hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will operationalize findings into detections, signatures, and SOAR playbooks, partnering with Threat Intelligence and Engineering teams to reduce dwell time.

You will lead, mentor, and develop analytics and tooling, using MITRE ATT&CK, AI/LLM-assisted methods, and deception techniques to advance the threat-hunting program across the organization.

Qualifications

• 7+ years in security ops with 4+ years threat hunting.
• Experience hunting in large, complex enterprises.
• MITRE ATT&CK-aligned hunts with outcomes.
• Hands-on with modern SIEM and EDR/XDR.
• Experience using AI/LLM-assisted tooling to accelerate hunting.
• Familiarity with AI/LLM threats and MITRE ATLAS framework.
• Knowledge of Diamond Model, Kill Chain, Pyramid of Pain.
• Strong scripting and automation skills.
• Excellent analytical and communication skills.
• Demonstrated leadership and mentorship.

Responsibilities

• Lead hypothesis-driven hunts across enterprise, cloud, and OT/IoT.
• Design analytics against large-scale telemetry to uncover tradecraft.
• Perform identity-centric hunting across Entra ID and SaaS.
• Cloud-native hunting across AWS, Azure, M365, and SaaS control planes.
• Convert hunt findings into durable detections and playbooks.
• Produce post-hunt reports with measurable outcomes.
• Partner with Threat Intelligence to operationalize intel into hunts.
• Support purple team exercises and validate detection efficacy.
• Develop tooling to support hunting and analyst efficiency.

Skills

Analytical Research

Artificial Intelligence (AI)

Cybersecurity Operations

Cyber Threat Hunting

Cyber Threat Intelligence

Endpoint Detection and Response (EDR)

IT Automation

Large Language Models (LLMs)

Mentorship

MITRE ATT&CK Framework

Project Leadership

Scripting

Security Incident Response

SIEM

Tools

Splunk

Sentinel

Elastic

CrowdStrike

Defender

SentinelOne

Tanium

Job description

Allstate is seeking a Lead Threat Hunter to direct hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will operationalize findings into detections, signatures, and SOAR playbooks, partnering with Threat Intelligence and Engineering teams to reduce dwell time.

You will lead, mentor, and develop analytics and tooling, using MITRE ATT&CK, AI/LLM-assisted methods, and deception techniques to advance the threat-hunting program across the organization.