Threat Hunting Analyst

aspenviewtech; United States; Hybrid; USD 90,000 - 120,000; Full time

Benefits offered by this job

Hybrid work model

Office days in Bogotá or Buenos Aires

Job summary

aspenviewtech in Bogotá or Buenos Aires is seeking a proactive SOC threat hunter (Tier 2/3) to investigate endpoint, identity, network, email, and cloud telemetry. You will turn threat intelligence into focused hunts, investigate suspicious activity, and collaborate with detection engineers to make findings repeatable.

You will run investigations across security and cloud data in SIEMs, translate techniques into hypotheses, and document detections and gaps for engineering follow-up.

Qualifications

• 3+ years as a Tier 2 or Tier 3 SOC analyst, incident responder, or threat hunter.
• Ability to describe an investigation from hypothesis to outcome, including a hunt with no malicious activity.
• Experience querying large datasets in Elastic, Splunk, Microsoft Sentinel, QRadar, or comparable SIEM.

Responsibilities

• Develop hunt questions with security leads using intelligence, incidents, and telemetry gaps.
• Translate attacker techniques into testable hypotheses and guide priorities with MITRE ATT&CK.
• Run investigations across security and cloud data in a SIEM; pivot on leads and filter noise.
• Escalate evidence of active attacks and assess potential incident scope.
• Document candidate detections and logging gaps for engineering follow-up.
• Write clear, reproducible reports describing methods, results, and limitations.

Skills

Threat hunting

SIEM experience

Report writing

Collaboration

English communication

Tools

Elastic

Splunk

Microsoft Sentinel

QRadar

Job description

Role overview

Conduct proactive, hypothesis-driven investigations across endpoint, identity, network, email, and cloud telemetry for a financial services environment. The analyst will turn threat intelligence into focused hunts, investigate suspicious activity, and work with detection engineers so valuable findings can become repeatable detections.

Responsibilities

• Develop hunt questions with security leads, using relevant intelligence, recent incidents, and known gaps in available telemetry.
• Translate attacker techniques into testable hypotheses, choose data sources and time windows, and use the MITRE ATT&CK framework to guide priorities.
• Run scheduled and ad hoc investigations across security and cloud data in a SIEM; pivot on leads and distinguish meaningful activity from noise.
• Escalate evidence of active attacks, and conduct indicator or behavior sweeps to assess potential incident scope.
• Document candidate detections and logging gaps for engineering follow-up.
• Write clear, reproducible reports describing methods, results, limitations, and steps others can use to repeat a hunt.

Requirements

• At least three years as a Tier 2 or Tier 3 SOC analyst, incident responder, or threat hunter, including hands-on proactive SIEM hunting.
• Ability to describe an investigation from hypothesis to outcome, including a hunt that found no malicious activity.
• Experience querying large datasets in Elastic, Splunk, Microsoft Sentinel, QRadar, or a comparable SIEM.
• Understanding of how living-off-the-land activity, credential or session abuse, lateral movement, and cloud control-plane misuse may appear in logs.
• Strong written English for reports and spoken English at B1 level or above.
• Collaborative, careful approach to investigations, including recognizing when evidence shows existing controls are working.
• Ability to pass identity, criminal history, employment, and education checks; work in a clean-desk, virtual desktop environment; and be permanently authorized to work in the country of residence without current or future visa sponsorship.

Nice to have

• Financial-sector threat experience, including fraud-related intrusion, ransomware, or business email compromise.
• Detection writing, malware triage, or memory forensics experience; relevant threat intelligence or incident response certifications.

Benefits and work setup

• Full-time, hybrid work based in Bogotá or Buenos Aires, with two office days and three work-from-home days each week, plus attendance at important in-person meetings.
• Work follows US Eastern business hours, without rotating shifts; occasional call-ins may be needed during major incidents.