{"id":2691442,"url":"https://alion.io/job/ncc-group-threat-hunter","title":"Threat Hunter","company":{"id":43360,"name":"NCC Group","domain":"nccgroup.com","url":"https://alion.io/company/nccgroup","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Pinpoint","truth_index":{"grade":"A","score":100,"open_postings":3,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":14,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manchester, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":92000,"max_usd":210000,"period":"year","method":"role_country_seniority_unknown","sample_n":3177},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"GitLab","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false}],"status":"live","first_seen_at":"2026-10-15T09:02:20Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-17T21:49:37Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"We are seeking a highly capable and hands-on Threat Hunter to join a passionate and motivated, industry-leading team focused on identifying sophisticated adversaries through hypothesis-driven analysis and automation. You will be responsible for proactively hunting and analysing advanced threats across the customers environment using our proprietary hunting framework, ensuring our threat models and threat hunts are tightly aligned to the customer.\nAs a Threat Hunter, you will actively search for cyber threats that evade traditional security solutions. Your role will involve conducting in-depth intelligence-led, hypothesis-driven analysis of TTPs and behaviours, and working cross-functionally with the Security Operations Centre Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks.\nKey Responsibilities\nUse NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts. \nLeverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections. \nCollaborate with detection engineering to convert threat hunt findings into high fidelity detection content. \nUtilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats. \nSupport the mapping of threat models to monitoring use cases in partnership with teams across the business. \nDocument and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling. \nProvide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact. \nSkills, Knowledge & Expertise\nThe ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration. \nThey have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions. \nExperienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks. \nExperience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings. \nThey should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments-including hybrid or cloud-native architectures like AWS, Azure, or GCP. \nThey will be comfortable presenting findings to stakeholders and documenting methodologies. \nThey thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.\n What we are looking for in you\nExperience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team role. \nSolid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation. \nDeep familiarity with hypothesis-driven threat hunting frameworks and methodologies. \nAbility to work autonomously while collaborating across security, engineering, and business teams. \nStrong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell). \nJob Benefits\nFlexible Working: Balance your work and personal life with our flexible working options.\nGenerous Holiday Allowance: Enjoy 25 days of holiday, plus bank holidays, with the option to buy up to 5 additional days of annual leave.\nMedicash & Critical Illness Scheme\nFinancial & Investment Benefits: Enjoy peace of mind with our Pension, Life Assurance, and Share Save Scheme.\nCommunity & Volunteering Programmes: Make a difference in your community with our volunteering opportunities.\nGreen Car Scheme: Drive green and save money with our eco-friendly car scheme.\nCycle Schem e: Stay fit and healthy with our cycle-to-work scheme.\nSpecial Time Off: Take time off for those big moments in life, like getting married/entering into a civil partnership, becoming a grandparent, and welcoming home a new pet.\n Family Planning: Benefit from our generous maternity and paternity leave, as well as time off and support for those undergoing fertility treatments.","description_format":"text","description_chars":4448,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Flexible schedule"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-16T09:02:20Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 4 · green card filings: 1","filings_12m":4,"filings_prev_12m":6,"green_card_filings_12m":1,"median_offered_wage_usd":120500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":3}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":14,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/ncc-group-threat-hunter","json_url":"https://alion.io/job/ncc-group-threat-hunter.json","meta":{"generated_at":"2026-10-17T22:22:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":3881,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":43360},"rest":"https://alion.io/mcp/rest/get_company?id=43360"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fncc-group-threat-hunter"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fncc-group-threat-hunter"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fncc-group-threat-hunter"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ncc-group-threat-hunter\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fncc-group-threat-hunter"}]}