Remote Threat Hunter & Insider Risk Investigator

Piper Companies; North Carolina; Hybrid; USD 140,000 - 165,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k)

PTO

Paid holidays

Job summary

Piper Companies seeks a Threat Hunter Investigator for a fully remote role with EST hours in the United States. You will proactively hunt insider threats, investigate incidents, and mitigate risks to protect critical IP and data across environments.

Responsibilities include developing detections in Splunk Enterprise Security, building RBA/UEBA workflows, and documenting runbooks. A strong cyber investigations background and MITRE ATT&CK alignment are essential for success.

Qualifications

• 8+ years of cyber investigations, insider threat analysis, and digital forensics.
• Hands-on Splunk Enterprise Security experience and detection engineering.
• Advanced SPL skills and custom detections and correlation searches.
• Experience with RBA and UEBA including risk scoring and anomaly detection.
• Strong threat hunting methodologies and translating intelligence into detections.

Responsibilities

• Conduct proactive threat hunting and insider threat investigations using logs, endpoints, user activity, and analytics.
• Investigate IP theft, data loss, and insider risk events; document findings and recommendations.
• Develop and tune detections within Splunk ES (SPL) and build detection content.
• Create and maintain Risk-Based Alerting (RBA) use cases and automated response workflows.
• Configure UEBA models across endpoint, cloud, network, and applications; improve alert quality.

Skills

Threat hunting

Insider threat

Incident response

Behavioral analytics

Threat intelligence

SPL queries

Detection engineering

UEBA

Education

Bachelor's degree in Cybersecurity, CS, IS or related field

Tools

Splunk Enterprise Security

Job description

Piper Companies seeks a Threat Hunter Investigator for a fully remote role with EST hours in the United States. You will proactively hunt insider threats, investigate incidents, and mitigate risks to protect critical IP and data across environments.

Responsibilities include developing detections in Splunk Enterprise Security, building RBA/UEBA workflows, and documenting runbooks. A strong cyber investigations background and MITRE ATT&CK alignment are essential for success.