Remote Threat Hunter & Detection Engineer

NinjaOne; Florida; Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne is seeking a Threat Hunter for the Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across endpoints, cloud, and network telemetry, turning findings into tangible detection packages for tooling and SOC consumption.

Ideal candidates have hands-on hunting experience, deep MITRE ATT&CK knowledge, and strong telemetry querying skills in SIEM/EDR environments. This role supports hybrid remote work within the USA.

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response
• Experience running hypothesis-driven hunts with telemetry
• Strong knowledge of adversary tactics, techniques and procedures (MITRE ATT&CK)
• Proficiency querying across security telemetry in SIEM/EDR/XDR
• Ability to translate hunt findings into detections and SOP guidance

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry
• Consume CTI and red-team/purple-team findings to prioritize hunts
• Map hunts to MITRE ATT&CK to track coverage
• Translate findings into detection packages with logic and enrichment
• Partner with red team on validation of configuration faults and gaps
• Surface posture gaps discovered during hunts and drive remediation
• Document hypotheses, methods and outcomes for reusable artifacts
• Contribute threat context during Sev 1 incidents in advisory capacity
• Other duties as needed

Skills

Threat hunting

MITRE ATT&CK

Telemetry querying

Documentation

Communication

Tools

SIEM

EDR/XDR

KQL

SPL

Python

Job description

NinjaOne is seeking a Threat Hunter for the Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across endpoints, cloud, and network telemetry, turning findings into tangible detection packages for tooling and SOC consumption.

Ideal candidates have hands-on hunting experience, deep MITRE ATT&CK knowledge, and strong telemetry querying skills in SIEM/EDR environments. This role supports hybrid remote work within the USA.