Proactive Threat Hunter: SIEM & Cloud Defender

aspenviewtech; United States; Hybrid; USD 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid work model

Office days in Bogotá or Buenos Aires

Job summary

aspenviewtech in Bogotá or Buenos Aires is seeking a proactive SOC threat hunter (Tier 2/3) to investigate endpoint, identity, network, email, and cloud telemetry. You will turn threat intelligence into focused hunts, investigate suspicious activity, and collaborate with detection engineers to make findings repeatable.

You will run investigations across security and cloud data in SIEMs, translate techniques into hypotheses, and document detections and gaps for engineering follow-up.

Qualifications

• 3+ years as a Tier 2 or Tier 3 SOC analyst, incident responder, or threat hunter.
• Ability to describe an investigation from hypothesis to outcome, including a hunt with no malicious activity.
• Experience querying large datasets in Elastic, Splunk, Microsoft Sentinel, QRadar, or comparable SIEM.

Responsibilities

• Develop hunt questions with security leads using intelligence, incidents, and telemetry gaps.
• Translate attacker techniques into testable hypotheses and guide priorities with MITRE ATT&CK.
• Run investigations across security and cloud data in a SIEM; pivot on leads and filter noise.
• Escalate evidence of active attacks and assess potential incident scope.
• Document candidate detections and logging gaps for engineering follow-up.
• Write clear, reproducible reports describing methods, results, and limitations.

Skills

Threat hunting

SIEM experience

Report writing

Collaboration

English communication

Tools

Elastic

Splunk

Microsoft Sentinel

QRadar

Job description

aspenviewtech in Bogotá or Buenos Aires is seeking a proactive SOC threat hunter (Tier 2/3) to investigate endpoint, identity, network, email, and cloud telemetry. You will turn threat intelligence into focused hunts, investigate suspicious activity, and collaborate with detection engineers to make findings repeatable.

You will run investigations across security and cloud data in SIEMs, translate techniques into hypotheses, and document detections and gaps for engineering follow-up.