Remote Threat Hunter — Hypothesis-Driven Defense

NinjaOne; Georgia; Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function and lead proactive, hypothesis-driven hunts across our environment. You will translate intelligence into concrete hunts and create detection packages for our tooling team and SOC consumption.

We value experience with MITRE ATT&CK, hands-on threat-hunting responsibilities, and the ability to produce durable detections and SOP guidance. The role supports hybrid remote work for candidates in the USA.

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response with hands-on threat-hunting
• Experience running hypothesis-driven hunts and translating findings into detections
• Knowledge of MITRE ATT&CK framework and ability to map hunts to it
• Ability to query and pivot across security telemetry at scale in SIEM/EDR/XDR
• Strong written communication for detection packages and SOPs

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry
• Consume CTI and red-team/purple-team findings to prioritize hunts
• Map hunts to MITRE ATT&CK to track coverage and gaps
• Translate hunt findings into detection packages and SOP guidance for tooling team
• Partner with red team to validate configurations and posture gaps
• Document hypotheses, methods, and outcomes for reusable hunting artifacts
• Contribute threat context during Sev 1 incidents in advisory capacity
• Other duties as needed

Skills

Threat hunting

MITRE ATT&CK knowledge

Hypothesis-driven analysis

Documentation/writing

Cross-team collaboration

Adversary behavior understanding

Education

GIAC or equivalent certifications

Cloud security certifications

OSCP or comparable

Tools

KQL

SPL

SIEM/EDR/XDR tooling

Cloud telemetry (CloudTrail, Entra ID/Azure AD)

Job description

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function and lead proactive, hypothesis-driven hunts across our environment. You will translate intelligence into concrete hunts and create detection packages for our tooling team and SOC consumption.

We value experience with MITRE ATT&CK, hands-on threat-hunting responsibilities, and the ability to produce durable detections and SOP guidance. The role supports hybrid remote work for candidates in the USA.