Remote Threat Hunter & Detection Engineer

NinjaOne; Austin (TX); Hybrid; USD 90,000 - 110,000; Full time

Benefits offered by this job

Hybrid remote work

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across our environment and translate findings into detection packages for our tooling and SOC.

You will work at the intersection of threat intelligence, detection engineering, and offensive validation, turning intelligence into durable detections and guidance. Hybrid remote in the USA, with offices in Austin and Tampa.

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response with hands-on threat-hunting responsibility.
• Experience running hypothesis-driven hunts and testing against telemetry.
• Proficiency querying across security telemetry at scale (KQL, SPL) in SIEM/EDR/XDR.
• Understanding of endpoint, identity, cloud, and network telemetry; know normal vs abnormal.
• Ability to translate hunt findings into durable detections and SOPs for tooling teams.
• Clear written communication for documentation and detection packages.

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Consume CTI and red-team findings to prioritize hunts by adversary behaviors.
• Map hunts to MITRE ATT&CK to track coverage and gaps.
• Translate hunt findings into detection packages and SOP guidance for tooling team.
• Collaborate with red team on validation of configuration faults and gaps.
• Document hypotheses, methods, and outcomes for reusable hunting artifacts.
• Contribute threat context during Sev 1 incidents in advisory capacity.
• Other duties as needed.

Skills

Hypothesis-driven hunts

MITRE ATT&CK

KQL/SPL querying

Telemetry knowledge

Detection engineering

Documentation

Tools

SIEM

EDR/XDR

Cloud telemetry

Job description

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across our environment and translate findings into detection packages for our tooling and SOC.

You will work at the intersection of threat intelligence, detection engineering, and offensive validation, turning intelligence into durable detections and guidance. Hybrid remote in the USA, with offices in Austin and Tampa.