Threat Hunter - Charlotte, Nc

Motion Recruitment; Charlotte (NC); On-site; USD 62,000 - 96,000; Full time

Benefits offered by this job

Medical Insurance

Dental Benefits

Vision Benefits

Paid Time Off (PTO)

401(k)

Job summary

Motion Recruitment is seeking a Threat Hunter in Charlotte to support proactive cybersecurity investigations across a complex enterprise. You will work with security data, SIEM platforms, and AI-generated findings to identify malicious behavior and drive appropriate responses.

The role sits between traditional threat hunting and cyber response, investigating suspicious activity, correlating data, and collaborating with incident response and engineering teams to remediate threats.

Qualifications

• Professional experience in a Security Operations Center.
• Strong experience with Splunk or another enterprise SIEM platform.
• Experience reviewing and correlating large volumes of security logs.
• Hands-on experience with endpoint detection and response tools.

Responsibilities

• Conduct proactive searches for suspicious and malicious activity.
• Analyze SIEM events, endpoint telemetry, and aggregated security logs.
• Investigate findings generated by automated and AI-driven security scanning.
• Validate vulnerabilities and determine the severity of identified issues.
• Investigate suspicious web activity, certificate misuse, and abnormal system behavior.
• Correlate events across multiple security tools and data sources.
• Determine whether findings require containment, escalation, or remediation.
• Partner with incident response and engineering teams to address confirmed threats.
• Document investigation results and recommended actions.
• Improve detection and investigation processes based on newly discovered threats.

Skills

SOC experience

Splunk

Log correlation

EDR tools

Threat hunting

ATT&CK knowledge

Python scripting

Cloud security

Job description

Job Description

A large financial services organization in Charlotte, North Carolina is hiring a Threat Hunter to support proactive cybersecurity investigations and response activities across a complex enterprise environment. This engineer will work with security data, endpoint telemetry, SIEM platforms, and findings generated by AI-based security scanning to identify potentially malicious behavior and determine the appropriate response. The role will sit between traditional threat hunting and cyber response. You’ll investigate suspicious activity, validate vulnerabilities and security findings, correlate information across multiple data sources, and work with security teams to contain or remediate confirmed issues.

Required Skills & Experience

• Professional experience in a Security Operations Center
• Strong experience with Splunk or another enterprise SIEM platform
• Experience reviewing and correlating large volumes of security logs
• Hands-on experience with endpoint detection and response tools
• Understanding of common attacker behaviors, indicators of compromise, and security events
• Experience investigating and responding to cybersecurity findings
• Ability to analyze activity across endpoints, applications, networks, and cloud environments
• Strong troubleshooting and analytical skills

Desired Skills & Experience

• Experience performing proactive threat hunting
• Familiarity with vulnerability management and remediation workflows
• Knowledge of web application security findings
• Experience investigating certificate or credential misuse
• Familiarity with MITRE ATT&CK
• Experience working with AI-generated or automated security findings
• Python or other scripting experience
• Background working with large-scale security data
• Experience collaborating with incident response, engineering, and DevSecOps teams

What You Will Be Doing Daily Responsibilities

• Conduct proactive searches for suspicious and malicious activity
• Analyze SIEM events, endpoint telemetry, and aggregated security logs
• Investigate findings generated by automated and AI-driven security scanning
• Validate vulnerabilities and determine the severity of identified issues
• Investigate suspicious web activity, certificate misuse, and abnormal system behavior
• Correlate events across multiple security tools and data sources
• Determine whether findings require containment, escalation, or remediation
• Partner with incident response and engineering teams to address confirmed threats
• Document investigation results and recommended actions
• Improve detection and investigation processes based on newly discovered threats

The Offer

• 12+ month contract
• Competitive hourly compensation

You Will Receive the Following Benefits

• Medical Insurance
• Dental Benefits
• Vision Benefits
• Paid Time Off (PTO)
• 401(k)

Applicants must be currently authorized to work in the United States on a full-time basis now and in the future.

Posted By: Nick Ramler