Senior Detection Engineering & Threat Hunting Analyst

Huntress; United States; À distance; USD 105 000 - 119 000; Plein temps

Avantages offerts par ce poste

Fully remote work

Annual US trip for Summer Summit

Home office setup reimbursement ($800)

12 weeks parental leave

Digital allowance ($185 AUD)

Home office stipend ($40 AUD)

Private health insurance

Stock options

BetterUp coaching

Résumé du poste

Huntress is seeking a Senior Detection Engineering and Threat Hunting Analyst to join our remote Australia team. You will design, test, and tune detections that protect millions of endpoints while collaborating with a 24/7 SOC and related teams.

You will hunt for stealthy attacker techniques, turn threat intel into detections, and scale detection across identities and endpoints. This role offers remote work, equity, and ongoing learning opportunities.

Qualifications

• Experience developing, testing, tuning, and documenting detections from threat intel or investigations.
• Ability to communicate findings through clear written reports.
• Knowledge of Windows internals.
• Understanding of adversary tradecraft and ATT&CK techniques.

Responsabilités

• Create, test, and tune detection rules across ITDR, SIEM, EDR, Windows, Linux, and macOS.
• Manage DE/TH requests and coordinate with partners.
• Undertake hypothesis-driven hunts across telemetry.
• Build dashboards and queries to surface intrusions.
• Investigate intrusions and provide incident reports.
• Contribute to community content and AI-driven workflows.
• Use AI workflows to prototype queries and validate outputs.

Connaissances

Detection engineering

Threat hunting

SOC operations

Threat intelligence

Outils

Sigma

Suricata

Snort

YARA

KQL

EQL

ES|QL

Splunk SPL

OSquery

Velociraptor

Description du poste

What We Do:

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, the company is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

the company now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

Reports to:

Senior Manager, Detection Engineering & Threat Hunting

Location:

Remote Australia

Compensation Range:

$150,000 to $170,000 AUD base plus bonus and equity

What You’ll Do:

Members of the the company DE&TH team wake up every morning with the honor of impeding threat actors through a combination of detection engineering and threat hunting. This team sits alongside our 24x7 Security Operations Center, and our Adversary Tactics & Tactical Response function, and plays a pivotal role in detecting threats actors before they get a chance to impact our partner environments.

As a Senior Detection Engineering and Threat Hunting (DE&TH) Analyst you should be drawn to the hard problems: detecting stealthy intrusions, managing false positives and false negatives at scale, and uncovering clues that may expose an evolving campaign across the company partners. In this role you will turn threat intelligence, or a hypothesis, into detections that help the SOC find real intrusions faster. While the SOC is responding to alerts within minutes, this team is developing detections and reviewing more ambiguous signs of attacker activity on a daily & weekly basis.

On the Detection Engineering side of the role, you will play a part in designing, building, and maintaining a resilient, scalable, and high-fidelity detection portfolio that enables the SOC to rapidly identify and respond to adversary activity. This will involve working with engineering and other adjacent teams to achieve a shared goal across multiple domains which includes identities and endpoints.

On the Threat Hunting side of the role, you will get to research new attacker tradecraft, test new theories, and review hunting data at scale for millions of endpoints to proactively hunt for, and disrupt, stealthy threat actor techniques that evade initial defenses.

If you love Detection Engineering and Threat Hunting at scale, whilst in the environment and energy of a SOC, this is the role for you!

Responsibilities:

• Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on their performance.


• Develop rules across a variety of the company products and operating systems such as: Identity Threat Detection and Response (ITDR), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Windows, Linux, and MacOS.


• Manage any DE&TH requests raised internally or escalated from our partners.


• Undertake hypothesis-driven hunts across the company telemetry, prioritising techniques and tradecraft that may evade high-fidelity detections and initial SOC review.


• Consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows.


• Build and refine hunting dashboards or queries required to surface potential intrusions.


• Review ambiguous signs of attacker activity across the company products, and surface likely intrusions that require deeper investigation.


• Investigate or elevate likely intrusions identified to ensure partners receive clear incident reports with accurate advice.


• Contribute findings to community-driven projects and create the company content such as blogs, social posts, videos, podcasts, and webinars.


• Use AI-assisted workflows to prototype queries, enrich analysis, and develop a scaffolding for detection rules, ensuring you apply sound judgment to validate the AI output. We expect everyone at the company to be able to use AI as a real part of how they work, not occasionally, but genuinely embedded in core workflows.

What You Bring To The Team:

• 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.


• Intermediate knowledge of Windows internals.


• Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.


• Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations.


• Ability to communicate findings through clear written reports.


• Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL.


• A sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system.


• A sound understanding of the roles different threat actors play and their associated goals, such as: initial access brokers, ransomware affiliates, and state-sponsored entities.


• Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments.

Bonus points for:

• Intermediate knowledge of Linux and MacOS internals.


• Hands-on experience using tools to remotely discover evidence of compromise such as OSquery, Velociraptor, and EDR/MDR/XDR platforms.


• Previous use of forensic tooling such as Eric Zimmerman's EZ Tools, RegRipper, Hayabusa, or Chainsaw to analyze endpoint artifacts.


• Intermediate malware analysis skills.

What We Offer:

• Fully remote work


• At least one annual trip to the US for Summer Summit, with additional local events in Australia!


• New starter home office set up reimbursement ($800 AUD)


• 12 weeks paid parental leave for both primary and secondary carers


• Monthly digital allowance for personal phone and internet costs ($185 AUD)


• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)


• Subsidised private health insurance through our preferred provider


• Stock options for all full-time employees


• Access to the BetterUp platform for coaching, personal, and professional growth

the company is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.

We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.

We do discriminate against hackers who try to exploit businesses of all sizes.

Accommodations:

If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [e-mail]. Please note that non-accommodation requests to this inbox will not receive a response.

the company uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.

#BI-Remote