Lead Threat Hunter — Intelligence-Led Security Champion

Allstate; Illinois; On-site; USD 120,000 - 175,000; Full time

Job summary

Allstate is seeking a Lead Threat Hunter to drive hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will operationalize findings into durable detections and playbooks, partnering with Threat Intelligence, Detection Engineering, IR, and Exposure Management to reduce dwell time and enterprise exposure.

You will mentor junior hunters and contribute to knowledge bases.

Qualifications

• 7+ years of experience in security operations with 4+ of those years dedicated to threat hunting.
• Deep experience hunting in large, complex enterprise environments.
• Demonstrable experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs.

Responsibilities

• Lead hypothesis-driven, intelligence-led hunt campaigns mapped to MITRE ATT&CK.
• Design and execute analytics against large-scale telemetry (SIEM, EDR/XDR, identity, cloud, network).
• Perform identity-centric hunting across Entra ID, AD, and SaaS platforms including MFA bypass and OAuth abuse.
• Conduct cloud-native hunting across AWS, Azure, M365, and SaaS control planes.

Skills

Analytical Research

Artificial Intelligence

Cybersecurity Operations

Threat Hunting

Threat Intelligence

EDR

IT Automation

LLMs

Mentorship

MITRE ATT&CK

Project Leadership

Scripting

Security Incident Response

SIEM

Job description

Allstate is seeking a Lead Threat Hunter to drive hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will operationalize findings into durable detections and playbooks, partnering with Threat Intelligence, Detection Engineering, IR, and Exposure Management to reduce dwell time and enterprise exposure.

You will mentor junior hunters and contribute to knowledge bases.