Remote Threat Hunter: Proactive, Hypothesis-Driven

NinjaOne; Maine; Hybrid; USD 80,000 - 110,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) plan

Unlimited PTO

Job summary

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across our environment and convert findings into durable detections for tooling and SOC consumption.

Work spans threat intel, detection engineering, and offensive validation. You will translate intel into concrete, deployable detections and collaborate with red teamers to close gaps in posture and configuration.

Qualifications

• 5+ years in security operations, detection engineering, CTI, or incident response with hands-on threat-hunting.
• Experience running hypothesis-driven hunts and turning findings into detections.
• Strong knowledge of attacker TTPs and MITRE ATT&CK, with ability to map hunts to coverage.

Responsibilities

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Prioritize hunts using CTI and red-team findings to address relevant adversary behaviors.
• Map hunts to MITRE ATT&CK to identify coverage gaps and improvements.
• Translate findings into detection packages with logic, context, and SOP guidance for tooling teams.
• Collaborate with red team on purple validation of configuration gaps.
• Surface posture gaps and drive remediation recommendations.
• Document hypotheses, methods, and outcomes for reusable hunting artifacts.
• Contribute threat context during Sev 1 incidents in advisory capacity.

Skills

Threat hunting

CTI integration

MITRE ATT&CK

Querying across SIEM/EDR/XDR

Detection engineering

Documentation

Purple/red team collaboration

Long-horizon investigation

Education

GIAC certifications (GCTI/GCFA/GCIA)

OSCP or offensive security certs

Cloud security certifications (AWS/Azure/GCP)

Tools

KQL

SPL

EDR/XDR tooling

Job description

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence function. You will run proactive, hypothesis-driven hunts across our environment and convert findings into durable detections for tooling and SOC consumption.

Work spans threat intel, detection engineering, and offensive validation. You will translate intel into concrete, deployable detections and collaborate with red teamers to close gaps in posture and configuration.