Threat Hunting Lead

aspenviewtech; United States; Hybrid; USD 120,000 - 160,000; Full time

Job summary

AspenViewTech is seeking a lead threat hunter to drive intelligence-driven investigations across endpoint, identity, network, email, and cloud data. You will set hunt priorities, analyze suspicious activity, and translate findings into deployed detections for a large consumer finance environment.

The role blends hands-on analysis, team leadership, and direct communication with client security leaders. You will mentor analysts across multiple locations and coordinate with detection engineering to

Qualifications

• Minimum five years in threat hunting, senior investigation, or incident response.
• Strong querying skills in a SIEM or data platform (Elastic, Splunk, Sentinel or equivalent).
• Familiarity with MITRE ATT&CK and credential or session abuse, lateral movement techniques.

Responsibilities

• Build a hunt plan from threat intel, incidents, and telemetry gaps.
• Conduct scheduled and ad hoc hunts across security and cloud data.
• Map investigations to MITRE ATT&CK and support SOC during major incidents.
• Collaborate with detection engineering to convert findings into backlog items for deployment.
• Document hunt tests, findings, rulings, and present results to security leadership.
• Mentor analysts across two locations and review hypotheses and methods.

Skills

Threat hunting

SIEM querying

Leadership

Client communication

Tools

Elastic

Splunk

Sentinel

Job description

Role overview

Lead intelligence-driven threat hunting for a large consumer finance environment. You’ll set hunt priorities, investigate suspicious activity across endpoint, identity, network, email, and cloud data, and ensure useful findings become deployed detections. The role combines hands‑on analysis, team leadership, and direct communication with client security leaders.

Responsibilities

• Build a hunt plan from threat intelligence, recent incidents, and known gaps in telemetry; prioritize hypotheses for investigation.
• Conduct scheduled and ad hoc hunts across security and cloud data, focusing on techniques such as credential abuse, living-off-the-land activity, and lateral movement.
• Map investigations to MITRE ATT&CK and support the SOC with broader searches during major incidents.
• Work with detection engineering to convert findings into backlog items and follow through to deployment.
• Document what each hunt tested, found, ruled out, or could not assess, and present results to security leadership.
• Direct and mentor analysts across two locations, reviewing their hypotheses, investigative methods, and query quality.

Requirements

• At least five years in threat hunting, senior investigation, or incident response, with examples of hunts taken from hypothesis to outcome.
• Strong querying skills in a SIEM or data platform such as Elastic, Splunk, Sentinel, or an equivalent, including analysis of large datasets.
• Working knowledge of MITRE ATT&CK and investigative skill with credential or session abuse, lateral movement, and living-off-the-land techniques.
• Experience leading or mentoring analysts, including across locations, and confidence presenting findings to client security leaders.
• Fluent English at approximately B2+ or C1 level.
• Ability to pass recurring identity, background, employment, and education checks; permanent authorization to work in the country of residence is required, with no visa sponsorship available.

Nice to have

• Elastic EQL or ES|QL, deep EDR experience, or hunting across identity and AWS data.
• Threat intelligence platforms, Python, Jupyter, detection writing, or knowledge of financial-sector threats such as fraud, ransomware, and business email compromise.
• Relevant threat hunting, incident response, or intelligence certifications.

Benefits and work setup

Full-time, hybrid work based in Bogotá or Buenos Aires: two days per week in the office and three from home, with in‑person attendance for important meetings. The schedule follows US Eastern business hours without shift rotation, though major incidents may require additional involvement.