Senior Threat Hunter: Splunk & UEBA Expert (Remote, EST)

Piper Companies; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

401(k)

Sick leave

PTO

Job summary

Piper Companies is seeking a Threat Hunting Investigator for a leading technology organization. This fully remote role operates on EST business hours and requires deep expertise in insider threat investigations, Splunk detection engineering, and hands-on SPL query development.

The ideal candidate has 5+ years in digital threat investigations, experience with UEBA and RBA programs, and a track record translating threat intel into production detections within enterprise security environments.

Qualifications

• 5+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including authoring complex SPL queries from scratch.
• Strong experience developing and managing Risk-Based Alerting (RBA) and User and Entity Behavior Analytics (UEBA) programs.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into production-ready detections and security workflows.

Responsibilities

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user activity, and protection of critical intellectual property.
• Develop, test, deploy, and tune advanced Splunk detection content using SPL, correlation searches, risk rules, and notable events.
• Configure and optimize RBA and UEBA workflows to identify high‑risk behaviors and improve threat detection capabilities.
• Produce clear investigative reports, technical documentation, and actionable recommendations for security stakeholders.

Skills

Threat hunting

Insider threat analysis

SPL queries

UEBA programs

MITRE ATT&CK

Tools

Splunk Enterprise Security

Job description

Piper Companies is seeking a Threat Hunting Investigator for a leading technology organization. This fully remote role operates on EST business hours and requires deep expertise in insider threat investigations, Splunk detection engineering, and hands-on SPL query development.

The ideal candidate has 5+ years in digital threat investigations, experience with UEBA and RBA programs, and a track record translating threat intel into production detections within enterprise security environments.