Threat Hunting Investigator

Piper Companies; United States; Remote; USD 140,000 - 165,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

401K

Job summary

Piper Companies is seeking a Threat Hunting Investigator for a long-term remote consulting engagement with a leading technology and cybersecurity organization. You will identify insider risk activity, develop advanced detections, and protect intellectual property through proactive investigations.

The role requires hands-on experience with Splunk, MITRE ATT&CK mappings, and enterprise security telemetry across endpoints, identity, cloud, and network layers.

Qualifications

• Bachelor's degree in CS, Cybersecurity, or related field.
• 8+ years of cyber investigations, insider threat analysis, IR, threat hunting, or digital forensics.
• 5+ years developing and maintaining detections in Splunk, including SPL, Enterprise Security, and RBA.
• Experience creating production-ready detection logic, correlation searches, and behavioral analytics.
• Strong understanding of endpoint security, Defender, Purview, cloud telemetry, and UEBA platforms.
• Working knowledge of Cisco technologies and enterprise networking related to security monitoring.

Responsibilities

• Lead proactive threat hunting across endpoint, identity, cloud, and network telemetry to identify insider risk activity.
• Design, build, and optimize advanced detections, correlation searches, and risk-based alerting workflows within Splunk Enterprise Security.
• Investigate intellectual property protection concerns via log analysis, forensics, and behavioral analytics across data sources.
• Translate threat intelligence and MITRE ATT&CK techniques into scalable detection content, playbooks, and response procedures.
• Collaborate with cross-functional security teams to improve monitoring, reduce false positives, and strengthen detection coverage.

Skills

Threat hunting

Insider threat analysis

Incident response

Digital forensics

SPL development

Splunk SPL

Risk-Based Alerting

UEBA

MITRE ATT&CK

Endpoint security

Microsoft Defender

Microsoft Purview

Cisco technologies

Education

Bachelor's degree in Computer Science / Cybersecurity

Tools

Splunk Enterprise Security

Microsoft Defender

Microsoft Purview

Cisco networking

Job description

Piper Companies is seeking a Threat Hunting Investigator to join a leading technology and cybersecurity organization for a long term remote consulting opportunity. The Threat Hunting Investigator will focus on identifying insider risk activity, developing advanced security detections, and protecting highly sensitive intellectual property through proactive investigations and threat analysis across enterprise environments.

Responsibilities of the Threat Hunting Investigator include:

• Lead proactive threat hunting efforts utilizing endpoint, identity, cloud, and network telemetry to identify suspicious user behavior and insider risk activity.
• Design, build, and optimize advanced detections, correlation searches, and risk-based alerting workflows within Splunk Enterprise Security and related security platforms.
• Investigate potential intellectual property protection concerns through log analysis, digital forensics, and behavioral analytics across multiple data sources.
• Transform threat intelligence, investigative findings, and MITRE ATT&CK techniques into scalable detection content, response procedures, and operational playbooks.
• Partner with cross-functional security teams to improve monitoring capabilities, reduce false positives, and strengthen overall detection coverage.

Qualifications for the Threat Hunting Investigator include:

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical discipline.
• 8+ years of experience conducting cyber investigations, insider threat analysis, incident response, threat hunting, or digital forensic examinations.
• 5+ years of hands-on experience developing and maintaining security detections within Splunk, including SPL development, Enterprise Security, and Risk-Based Alerting (RBA).
• Experience creating production-ready detection logic, correlation searches, behavioral analytics, and measurable security use cases from initial threat hypotheses.
• Strong understanding of endpoint security, Microsoft Defender, Microsoft Purview, cloud-based telemetry, and user behavior analytics platforms.
• Working knowledge of Cisco technologies, enterprise networking concepts, and the relationship between infrastructure assets and security monitoring programs.

Compensation for the Threat Hunting Investigator:

Salary Range: $140,000-$165,000/year (USD)

Comprehensive Benefits: Medical, Dental, Vision, sick leave if required by law, and 401K

This job opens for applications on 10/30/26. Applications for this job will be accepted for at least 30 days from the posting date.

Keywords: threat hunting, insider threat, Splunk, SPL, threat detection, cyber investigations, digital forensics, incident response, SIEM, Splunk Enterprise Security, risk based alerting, RBA, UEBA, Microsoft Defender, Microsoft Purview, telemetry analysis, security operations, behavioral analytics, endpoint security, intellectual property protection, MITRE ATT&CK, correlation searches, cloud security, log analysis, threat intelligence, security engineering, cyber defense, insider risk management, network security, detection engineering, Cisco technologies, security monitoring, incident investigation, security analytics, SOC, enterprise security, forensic analysis, risk management, cybersecurity.