Remote Threat Hunter Investigator - Insider Threat & Detection

Piper Companies; North Carolina; Hybrid; USD 140,000 - 165,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k)

Paid time off

Paid holidays

Additional leave

Job summary

Piper Companies is seeking a Threat Hunter Investigator to join a leading technology organization based in Raleigh, NC. This fully remote role operates on EST hours and focuses on proactively identifying, investigating, and mitigating insider threats to protect critical IP and data.

The ideal candidate will have 8+ years in cyber investigations, strong Splunk ES experience, and advanced SPL skills to develop detections, RBA/UEBA models, and robust incident response workflows.

Qualifications

• Bachelor's degree in cybersecurity, CS, info systems, or related field.
• 8+ years in cyber investigations, insider threat, and digital forensics.
• Strong hands-on Splunk Enterprise Security experience and threat detection.
• Expertise in writing SPL queries and custom detections.
• Experience with risk scoring, anomaly detection, and UEBA.

Responsibilities

• Conduct proactive threat hunting and insider threat investigations using logs and behavior analytics.
• Investigate IP theft, data loss, and insider risk events with documented findings.
• Develop and tune detections within Splunk Enterprise Security (SPL).
• Build Risk-Based Alerting use cases and automated responses.
• Configure UEBA models across endpoints, cloud, network, and apps.
• Create runbooks and detection content, improving alert quality and MITRE ATT&CK alignment.

Skills

Splunk Enterprise Security

SPL queries

Threat hunting

UEBA

RBA

Digital forensics

Insider threat investigations

Cybersecurity fundamentals

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or related field

Tools

Splunk Enterprise Security

Job description

Piper Companies is seeking a Threat Hunter Investigator to join a leading technology organization based in Raleigh, NC. This fully remote role operates on EST hours and focuses on proactively identifying, investigating, and mitigating insider threats to protect critical IP and data.

The ideal candidate will have 8+ years in cyber investigations, strong Splunk ES experience, and advanced SPL skills to develop detections, RBA/UEBA models, and robust incident response workflows.