Threat Hunter: Proactive MITRE-Driven Security Analyst

NTT DATA, Inc.; Addison (TX); Hybrid; USD 107,000 - 178,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) match

Paid time off

Job summary

NTT DATA Services is seeking a Security Analysis Threat Hunter in Addison, TX, Hybrid. The role emphasizes hypothesis-driven threat hunts aligned to MITRE ATT&CK, working closely with SOC, SIEM, Vulnerability Management, and Incident Response teams to enhance detection coverage and reduce attacker dwell time.

The position requires 10+ years in cyber security, strong TTP knowledge, and hands-on enterprise hunting with SIEM/query languages. On-site presence four days a week is expected.

Qualifications

• 10+ years of Cyber Security experience.
• Hands-on threat hunting in enterprise environments.
• Strong written and verbal communication for technical/executive audiences.

Responsibilities

• Conduct hypothesis-driven threat hunts aligned to MITRE ATT&CK.
• Identify attacker behavior not detected by alerts.
• Ingest threat intel into hunting hypotheses and detections.
• Develop advanced threat hunting queries across SIEM/EDR/analytics.
• Collaborate with SOC/IR to elevate threats and containment.
• Identify telemetry gaps and work with engineers to improve logging.
• Feed hunt results into detection rules and threat briefs.
• Participate in threat hunt sessions and customer discussions.

Skills

Threat hunting

MITRE ATT&CK

SIEM query languages

EDR/XDR analysis

Threat intelligence

Tools

SIEM platforms

EDR/XDR solutions

Threat hunting notebooks

Job description

NTT DATA Services is seeking a Security Analysis Threat Hunter in Addison, TX, Hybrid. The role emphasizes hypothesis-driven threat hunts aligned to MITRE ATT&CK, working closely with SOC, SIEM, Vulnerability Management, and Incident Response teams to enhance detection coverage and reduce attacker dwell time.

The position requires 10+ years in cyber security, strong TTP knowledge, and hands-on enterprise hunting with SIEM/query languages. On-site presence four days a week is expected.