Senior Threat Hunter: Proactive CTI-Driven Defense Lead

Brown Brothers Harriman & Co.; Boston (MA); On-site; USD 110,000 - 160,000; Full time

Job summary

Brown Brothers Harriman & Co. (BBH) in Boston is seeking a Senior Threat Hunter to join our Cyber Threat Monitoring Team.

You will lead advanced SOC investigations, perform proactive threat hunting across SIEM, EDR, identity, network and cloud logs, and escalate complex incidents with technical analysis. The role emphasizes CTI-driven detection, MITRE ATT&CK-aligned hypotheses, and collaboration with SOC analysts, detection engineers, and security leadership to improve detection and response

Qualifications

• Bachelor’s degree or higher in a cyber-related field.
• 5+ years in Security Operations, Incident Response, Threat Hunting, or related roles.
• Hands-on experience with SIEM/EDR and enterprise security monitoring tools.
• Familiarity with MITRE ATT&CK and attacker TTP analysis.

Responsibilities

• Lead and support advanced SOC investigations, incident response activities, and Tier-3 escalations, providing deep technical analysis of security alerts.
• Perform proactive threat hunting across SIEM, EDR, identity, network, and cloud logs to identify threats.
• Analyze attacker behaviors to develop threat hunting hypotheses and MITRE ATT&CK-aligned detection strategies.
• Investigate complex alerts to determine root cause, scope, and impact.
• Collaborate with security teams to improve detection logic, playbooks, and response procedures.
• Contextualize incidents with CTI sources and stay current on emerging threats.

Skills

Threat hunting

SOC investigations

Incident response

SIEM

EDR

MITRE ATT&CK

Analytical thinking

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Splunk SPL

Microsoft KQL

Job description

Brown Brothers Harriman & Co. (BBH) in Boston is seeking a Senior Threat Hunter to join our Cyber Threat Monitoring Team.

You will lead advanced SOC investigations, perform proactive threat hunting across SIEM, EDR, identity, network and cloud logs, and escalate complex incidents with technical analysis. The role emphasizes CTI-driven detection, MITRE ATT&CK-aligned hypotheses, and collaboration with SOC analysts, detection engineers, and security leadership to improve detection and response