Threat Hunter

Mars Security; New York (NY); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Ground-floor opport.

Direct access to founders

Adversary research exposure

Competitive compensation

Job summary

Mars Security is seeking a Threat Hunter in New York to run real hunts and develop detection logic that closes gaps in customers' environments. You will work directly with founders and customers to shape the product, applying hands-on threat hunting, threat intelligence, and adversary research to detect and mitigate active campaigns.

This role emphasizes discovery of what a security stack would miss, with opportunities to influence platform strategy and detection engineering at scale.

Qualifications

• 5+ years hands-on threat hunting experience.
• Proven ability to write detection rules for real attacks.
• Strong data analysis skills for high-volume telemetry.
• Solid understanding of attacker TTPs and campaigns.
• Knowledge of infrastructure: networking, cloud, identity, endpoints.

Responsibilities

• Run threat hunts across customer environments using SIEM and EDR.
• Research adversary infrastructure, tactics, and tooling.
• Build and validate detection rules and hunt queries.
• Develop and maintain detection content across platforms.
• Analyze large datasets to surface anomalies and indicators.
• Contribute to platform with scalable hunting and detection practices.

Skills

Threat hunting

Detection engineering

Data analysis

TTP knowledge

Offensive security

Networking / Cloud

Python scripting

Self-learning

Customer-facing

Team collaboration

Tools

SIEM

EDR

Cloud platforms

Job description

About Mars Security

Mars Security is an early-stage cybersecurity company building a new category of security technology, backed by deep hands-on experience from offensive security, threat intelligence, and security operations.

About Mars Security

Mars Security is an early-stage cybersecurity company building a new category of security technology, backed by deep hands-on experience from offensive security, threat intelligence, and security operations.

We're building a platform that lets security teams run continuous threat hunting and detection engineering across their existing stack. Most SOCs cannot tell you which active campaigns their environment would catch today. Mars closes that gap.

Founded by experienced operators, backed by world-class investors, and working with design partners across financial services, healthcare, pharma, and industrial security. We're building a team of people who thrive on ownership, ambiguity, and impact.

About The Role

Mars Security is looking for a Threat Hunter who hunts because they cannot help it. "Not because someone filed a ticket." This role sits at the intersection of detection engineering, threat intelligence, and adversary research. You will run real hunts against real environments, build detection logic that closes actual gaps, and feed what you find back into the platform. You will work directly with founders and directly with customers. What you discover shapes the product.

If your instinct when you see a security stack is to figure out what it would miss, you should be talking to us.

What You'll Do

• Run threat hunts across customer environments using SIEM, EDR, cloud, identity and etc.
• Research adversary infrastructure, tactics, and tooling to stay ahead of what customers are actually facing
• Build and validate detection rules and hunt queries grounded in real attacker TTPs and active campaigns
• Develop and maintain detection content across multiple platforms and data sources
• Analyze large datasets to surface anomalies, behavioral patterns, and attack indicators that automated systems miss
• Contribute to the platform by identifying what good hunting and detection engineering looks like at scale

What We're Looking For

• 5+ years Hands-on threat hunting experience
• Detection engineering experience: you've written rules that caught real attacks, not just passed tests
• Strong data analysis skills - comfortable querying and interpreting telemetry at volume
• Solid understanding of attacker TTPs, adversary tradecraft, and how campaigns operate end to end
• Offensive security knowledge: you understand how attacks are built, not just what they look like in logs
• Familiarity with infrastructure: networking, identity, cloud, endpoint. You know where attackers hide because you know how the plumbing works
• Python proficiency for scripting, automation, and analysis
• A pattern of self-directed learning. This field moves fast. You move faster.
• Malware analysis, threat intelligence, or red team background is a strong plus
• Excellent written and verbal English communication skills
• Strong customer-facing skills and ability to build trusted relationships with customers
• Team player with strong collaboration and communication skills

Why Mars Security

• Ground-floor opportunity at a well-funded, fast-growing cybersecurity company
• Direct access to founders and meaningful influence on the product roadmap
• Deep exposure to adversary research and real-world detection engineering at scale
• Work alongside a team built from offensive security and threat intelligence practitioners