Senior Threat Hunter: Intelligence-Led, Cloud & AI Security

Allstate; United States; On-site; USD 140,000 - 230,000; Full time

Job summary

Allstate is seeking a Lead Threat Hunter to lead hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will identify adversary tradecraft, operationalize findings into durable detection logic, and partner with Threat Intelligence, Detection Engineering, IR, and other teams to reduce dwell time.

You will leverage MITRE ATT&CK, the Pyramid of Pain, and the Diamond Model to drive measurable risk reduction, while mentoring junior hunters and developing

Qualifications

• 7+ years of security operations with 4+ years threat hunting experience.
• Experience executing MITRE ATT&CK-aligned hunts with documented outcomes.
• Hands-on with modern SIEM and EDR/XDR platforms.
• Experience using AI/LLM-assisted tooling to accelerate hunting and analytic development.
• Knowledge of AI/LLM environments and related threats.

Responsibilities

• Lead hypothesis-driven, intelligence-led hunt campaigns mapped to MITRE ATT&CK.
• Design and execute analytics against security telemetry to uncover evasive adversary tradecraft.
• Perform identity-centric hunting across Entra ID, AD, and SaaS platforms.
• Conduct cloud-native hunting across AWS, Azure, M365, and SaaS control planes.
• Convert hunt findings into durable detections and playbooks with Detection Engineering.
• Develop and tune deception-generated activity detection requirements.
• Produce post-hunt reports with measurable outcomes tied to exposure reduction.
• Mentor junior hunters and contribute to knowledge bases and hunt libraries.

Skills

Threat hunting

MITRE ATT&CK

AI/LLM tooling

Python scripting

PowerShell/GO/Bash

Tools

Splunk

Sentinel

Elastic

CrowdStrike

Defender

S SentinelOne

Tanium

Sigma

YARA

Job description

Allstate is seeking a Lead Threat Hunter to lead hypothesis-driven, intelligence-led hunts across enterprise, cloud, and OT/IoT environments. You will identify adversary tradecraft, operationalize findings into durable detection logic, and partner with Threat Intelligence, Detection Engineering, IR, and other teams to reduce dwell time.

You will leverage MITRE ATT&CK, the Pyramid of Pain, and the Diamond Model to drive measurable risk reduction, while mentoring junior hunters and developing