Senior Threat Hunter: AI-Driven Enterprise & Cloud

Allstate Insurance Co.; Illinois; Hybrid; USD 120,000 - 175,000; Full time

Job summary

Allstate Insurance Co. is seeking a Lead Threat Hunter to guide hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments.

You will transform hunt findings into durable detections, signatures, and SOAR playbooks while mentoring junior hunters and collaborating with Threat Intelligence, IR, and Detection Engineering teams. You will leverage MITRE ATT&CK, AI-assisted tooling, and advanced telemetry to reduce dwell time and strengthen enterprise defenses across

Qualifications

• 7+ years in security operations with 4+ years dedicated to threat hunting.
• Deep experience hunting in large, complex enterprise environments.
• Demonstrable experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs.
• Hands-on experience with modern SIEM (Splunk, Sentinel, Elastic) and EDR/XDR (CrowdStrike, Defender, SentinelOne, Tanium).
• Demonstrated experience using AI/LLM-assisted tooling (e.g., Security Copilot, custom GPTs, agentic workflows, embeddings-based analytics).
• Knowledge of MITRE ATLAS framework, OWASP Top 10 for LLM Applications, and AI-specific threats.

Responsibilities

• Lead hypothesis-driven, intelligence-led hunt campaigns from formulation through reporting, mapped to MITRE ATT&CK.
• Perform identity-centric hunting across Entra ID, Active Directory, and SaaS platforms—token theft and MFA bypass.
• Conduct cloud-native hunting across AWS, Azure, M365, and SaaS control planes.
• Convert hunt findings into durable detections, signatures, and SOAR playbooks with Detection Engineering.
• Develop and tune deception-generated activity signals and thresholds.
• Produce post-hunt reports with explicit evidence and measurable outcomes tied to exposure reduction.
• Mentor junior hunters and contribute to hunt libraries and training.

Skills

MITRE ATT&CK

Python scripting

PowerShell

EDR/XDR

SIEM

Tools

Splunk

Sentinel

Elastic

CrowdStrike

Defender

SentinelOne

Tanium

Job description

Allstate Insurance Co. is seeking a Lead Threat Hunter to guide hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments.

You will transform hunt findings into durable detections, signatures, and SOAR playbooks while mentoring junior hunters and collaborating with Threat Intelligence, IR, and Detection Engineering teams. You will leverage MITRE ATT&CK, AI-assisted tooling, and advanced telemetry to reduce dwell time and strengthen enterprise defenses across