Remote Threat Hunter & Incident Response Expert (Splunk)

Zachary Piper, LLC; Denver (CO); Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical benefits

Dental & Vision

401(k)

PTO

Job summary

Piper Companies is seeking an Instant Response Threat Investigator for a leading technology organization. This remote role operates on MST business hours, supporting rapid incident response, threat detection, and proactive threat analysis across enterprise environments.

Responsibilities include proactive threat hunting focused on insider threats and suspicious user behavior; designing and tuning Splunk detections; configuring UEBA; and producing detailed investigative reports to drive security

Qualifications

• 8+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including writing complex SPL queries and developing production-ready detections.
• Strong experience with Risk-Based Alerting (RBA), UEBA, and security detection engineering methodologies.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into operational detections, response workflows, and measurable security outcomes.

Responsibilities

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user behavior, and protection of critical intellectual property.
• Design, develop, test, deploy, and tune advanced Splunk detections, correlation searches, risk rules, and RBA workflows using SPL.
• Configure and optimize UEBA detections and behavioral analytics to identify high-risk activity across enterprise environments.
• Produce detailed investigative reports, technical documentation, and actionable recommendations to support security operations and risk mitigation.

Skills

Threat hunting

Incident response

Security monitoring

MITRE ATT&CK knowledge

Tools

Splunk Enterprise Security

SPL queries

Job description

Piper Companies is seeking an Instant Response Threat Investigator for a leading technology organization. The Instant Response Threat Investigator is a Remote position operating on MST business hours. An ideal candidate for the Instant Response Threat Investigator is an experienced cybersecurity professional with a strong background in rapid incident response, threat detection, security monitoring, incident investigation, and proactive threat analysis. The successful candidate will be skilled in leveraging security tools and data sources to quickly identify potential risks, investigate suspicious activity, and strengthen the organization's overall security posture.

Responsibilities of the Threat Hunting Investigator:

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user behavior, and protection of critical intellectual property.
• Design, develop, test, deploy, and tune advanced Splunk detections, correlation searches, risk rules, and RBA workflows using SPL.
• Configure and optimize UEBA detections and behavioral analytics to identify high-risk activity across enterprise environments.
• Produce detailed investigative reports, technical documentation, and actionable recommendations to support security operations and risk mitigation.

Qualifications of the Threat Hunting Investigator:

• 8+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including writing complex SPL queries from scratch and developing production-ready detections.
• Strong experience with Risk-Based Alerting (RBA), User and Entity Behavior Analytics (UEBA), and security detection engineering methodologies.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into operational detections, response workflows, and measurable security outcomes.

Compensation for the Threat Hunting Investigator includes:

• Comprehensive benefits package including medical, dental, vision, 401(k), sick leave as required by law, and PTO.

This job opens for applications on 10/16/2026. Applications for this job will be accepted for at least 30 days from the posting date.

#LI-MM9

#LI-REMOTE