Proactive Cyber Threat Hunter & Detection Engineer

Jobvite, Inc.; Austin, Tampa (TX, FL); Hybrid; USD 90,000 - 120,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

401(k) Plan

Unlimited PTO

Growth Opportunities

Job summary

NinjaOne is seeking a Threat Hunter to join the Cyber Threat Intelligence function and drive proactive, hypothesis-led hunts across our environment. You’ll translate intelligence into durable detections and detection packages for operationalization by the tooling team and consumption by the SOC.

In this role you will surf across endpoint, identity, cloud, and network telemetry, map hunts to MITRE ATT&CK, and communicate findings with clear documentation.

Qualifications

• 5+ years in a security operations, detection engineering, CTI, or incident response role with meaningful hands-on threat-hunting responsibility.
• Demonstrated experience running hypothesis-driven hunts, testing against telemetry, and concluding outcomes, not just triage.
• Strong working knowledge of adversary TTPs and practical fluency with the MITRE ATT&CK framework.
• Proficiency querying and pivoting across security telemetry at scale in a SIEM/EDR/XDR (KQL, SPL, or equivalent).
• Solid understanding of endpoint, identity, cloud, and network telemetry and normal vs. abnormal patterns.
• Ability to turn a hunt finding into a detection recommendation with context and fidelity considerations.
• Understanding of the detection lifecycle and the importance of signal-to-noise quality for SOC.
• Clear written communication for documentation, detection packages, and SOPs.
• Plan and sustain long-horizon hunt campaigns with limited day-to-day direction.

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Consume CTI and red-team findings to prioritize hunts against relevant adversary behaviors.
• Map hunts to MITRE ATT&CK to track coverage and identify gaps.
• Translate hunt findings into detection packages and SOP guidance for tooling teams.
• Partner with red teamers on purple validation of configuration faults and gaps.
• Surface posture gaps discovered during hunts and drive remediation actions.
• Document hypotheses, methods, and outcomes for reusable hunting knowledge.
• Contribute threat context during Sev 1 incidents in an advisory capacity.
• Other duties as needed.

Skills

Adversary mindset

Patience and persistence

Analytical thinking

Detections documentation

Effective communication

Curiosity

Tools

KQL

SPL

Python

Job description

NinjaOne is seeking a Threat Hunter to join the Cyber Threat Intelligence function and drive proactive, hypothesis-led hunts across our environment. You’ll translate intelligence into durable detections and detection packages for operationalization by the tooling team and consumption by the SOC.

In this role you will surf across endpoint, identity, cloud, and network telemetry, map hunts to MITRE ATT&CK, and communicate findings with clear documentation.