Remote Threat Hunter & Detection Architect

NinjaOne; Texas; Hybrid; USD 90,000 - 125,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function in the United States. You will conduct proactive, hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry and translate findings into durable detections and SOPs for the tooling team and SOC.

You will collaborate with CTI and red-team findings to prioritize hunts, map activity to MITRE ATT&CK, and drive improvements in detection coverage and posture across our environment.

Qualifications

• 5+ years in security operations, detection engineering or CTI with hands-on threat hunting.
• Experience running hypothesis-driven hunts informed by telemetry.
• Strong knowledge of attacker TTPs and MITRE ATT&CK.
• Proficiency querying security telemetry at scale (KQL, SPL, etc.).
• Solid understanding of endpoint, identity, cloud and network telemetry.
• Ability to translate hunt findings into durable detections and SOPs.
• Clear written communication for documentation and SOPs.

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Consume CTI and red-team findings to prioritize hunts against relevant adversary behaviors.
• Map hunts to MITRE ATT&CK to identify coverage gaps.
• Translate findings into detection logic and enrichment for tooling teams.
• Collaborate with red teamers on validation of config faults and gaps.
• Document hypotheses, methods, and outcomes for reusable artifacts.

Skills

Threat hunting

MITRE ATT&CK

Threat intel integration

Documentation

Communication

Tools

KQL

SPL

EDR/XDR

SIEM

Job description

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function in the United States. You will conduct proactive, hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry and translate findings into durable detections and SOPs for the tooling team and SOC.

You will collaborate with CTI and red-team findings to prioritize hunts, map activity to MITRE ATT&CK, and drive improvements in detection coverage and posture across our environment.