Threat Hunting Investigator

Zachary Piper Solutions; United States; Remote; USD 140,000 - 165,000; Full time

Job summary

Piper Companies is seeking a Threat Hunting Investigator for a long-term remote consulting engagement. The role focuses on insider risk detection, proactive threat hunting, and protecting intellectual property across enterprise environments using Splunk and related security platforms.

You will design detections, respond to incidents, and translate MITRE ATT&CK techniques into scalable content while partnering with security teams to strengthen monitoring and reduce false positives.

Qualifications

• 8+ years of experience conducting cyber investigations, insider threat analysis, incident response, threat hunting, or digital forensics.
• 5+ years of hands-on experience developing and maintaining security detections within Splunk, including SPL development, Enterprise Security, and Risk-Based Alerting.
• Experience creating production-ready detection logic, correlation searches, behavioral analytics and measurable security use cases from initial threat hypotheses.
• Strong understanding of endpoint security and cloud-based telemetry.
• Working knowledge of enterprise networking concepts and security monitoring programs.

Responsibilities

• Lead proactive threat hunting using endpoint, identity, cloud, and network telemetry to identify insider risk activity.
• Design, build, and optimize detections, correlations, and alerting workflows within Splunk and related platforms.
• Investigate intellectual property protection concerns through log analysis, forensics, and behavioral analytics across data sources.
• Translate MITRE ATT&CK techniques into scalable detection content, response procedures, and playbooks.
• Collaborate with cross-functional security teams to improve monitoring and reduce false positives.

Skills

Cyber investigations

Insider threat analysis

Incident response

Threat hunting

Digital forensics

MITRE ATT&CK

Telemetry analysis

Security operations

Risk-based alerting

Education

Bachelor's degree in CS/Cybersecurity

Tools

Splunk

Splunk Enterprise Security

SPL development

Microsoft Defender

Microsoft Purview

Cisco technologies

Job description

Piper Companies is seeking a Threat Hunting Investigator to join a leading technology and cybersecurity organization for a long term remote consulting opportunity. The Threat Hunting Investigator will focus on identifying insider risk activity, developing advanced security detections, and protecting highly sensitive intellectual property through proactive investigations and threat analysis across enterprise environments.

Responsibilities of the Threat Hunting Investigator include:

• Lead proactive threat hunting efforts utilizing endpoint, identity, cloud, and network telemetry to identify suspicious user behavior and insider risk activity.
• Design, build, and optimize advanced detections, correlation searches, and risk-based alerting workflows within Splunk Enterprise Security and related security platforms.
• Investigate potential intellectual property protection concerns through log analysis, digital forensics, and behavioral analytics across multiple data sources.
• Transform threat intelligence, investigative findings, and MITRE ATT&CK techniques into scalable detection content, response procedures, and operational playbooks.
• Partner with cross-functional security teams to improve monitoring capabilities, reduce false positives, and strengthen overall detection coverage.

Qualifications for the Threat Hunting Investigator include:

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical discipline.
• 8+ years of experience conducting cyber investigations, insider threat analysis, incident response, threat hunting, or digital forensic examinations.
• 5+ years of hands‑on experience developing and maintaining security detections within Splunk, including SPL development, Enterprise Security, and Risk‑Based Alerting (RBA).
• Experience creating production-ready detection logic, correlation searches, behavioral analytics and measurable security use cases from initial threat hypotheses.
• Strong understanding of endpoint security, Microsoft Defender, Microsoft Purview, cloud‑based telemetry, and user behavior analytics platforms.
• Working knowledge of Cisco technologies, enterprise networking concepts, and the relationship between infrastructure assets and security monitoring programs.

Compensation for the Threat Hunting Investigator:

Salary Range: $140,000-$165,000/year (USD)

Comprehensive Benefits: Medical, Dental, Vision, sick leave if required by law, and 401K

This job opens for applications on 10/1/26. Applications for this job will be accepted for at least 30 days from the posting date.

Keywords: threat hunting, insider threat, Splunk, SPL, threat detection, cyber investigations, digital forensics, incident response, SIEM, Splunk Enterprise Security, risk based alerting, RBA, UEBA, Microsoft Defender, Microsoft Purview, telemetry analysis, security operations, behavioral analytics, endpoint security, intellectual property protection, MITRE ATT&CK, correlation searches, cloud security, log analysis, threat intelligence, security engineering, cyber defense, insider risk management, network security, detection engineering, Cisco technologies, security monitoring, incident investigation, security analytics, SOC, enterprise security, forensic analysis, risk management, cybersecurity.

#LI-MB1 #LI-REMOTE