Threat Hunter – Hypothesis‑Driven Defender

TECH - TEST - DO NOT APPLYNinjaOne; United States; À distance; USD 80 000 - 110 000; Plein temps

Avantages offerts par ce poste

Hybrid remote

Benefits package

401(k) plan

Unlimited PTO

Growth opportunities

Résumé du poste

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence team and run proactive, hypothesis-driven hunts across our environment. You will translate intelligence into concrete hunts and craft detection packages for our tooling team and SOC.

Located in the United States with remote-friendly options, this role emphasizes long-horizon investigations, collaboration with red teams, and delivering durable detections to improve security posture.

Qualifications

• 5+ years in security ops, detection eng, CTI, or IR with hands-on threat hunting.
• Experience running hypothesis-driven hunts and turning telemetry into conclusions.
• Strong knowledge of adversary TTPs and MITRE ATT&CK.
• Proficiency querying telemetry at scale (KQL/SPL) in SIEM/EDR/XDR.
• Understanding of endpoint, identity, cloud, and network telemetry.
• Ability to translate hunt findings into detections with context.
• Clear written communication for docs and SOPs.
• Willingness to sustain long-horizon hunt campaigns.

Responsabilités

• Plan and run hypothesis-driven hunts across endpoint, identity, cloud, and network telemetry.
• Consume CTI and red-team findings to prioritize hunts.
• Map hunts to MITRE ATT&CK to track coverage.
• Translate hunt findings into detection packages and SOP guidance.
• Partner with red team on purple validation of configuration gaps.
• Surface posture gaps and drive remediation recommendations.
• Document hypotheses, methods, and outcomes for reusable artifacts.
• Contribute threat context during Sev 1 incidents in advisory capacity.
• Other duties as needed.

Connaissances

Adversary mindset

Patience & persistence

Analytical thinking

Durable detections

Effective communication

Curiosity

Outils

KQL

SPL

EDR/XDR

Description du poste

NinjaOne is seeking a Threat Hunter to join our Cyber Threat Intelligence team and run proactive, hypothesis-driven hunts across our environment. You will translate intelligence into concrete hunts and craft detection packages for our tooling team and SOC.

Located in the United States with remote-friendly options, this role emphasizes long-horizon investigations, collaboration with red teams, and delivering durable detections to improve security posture.