{"id":2300678,"url":"https://alion.io/job/ninjaone-cyber-threat-hunter","title":"Cyber Threat Hunter","company":{"id":782,"name":"NinjaOne","domain":"ninjaone.com","url":"https://alion.io/company/ninjaone","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jobvite","truth_index":{"grade":"A","score":100,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":8,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Austin, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":80000,"max":110000,"currency":"USD","period":"year","gross":null,"usd_annual":110000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-10-11T21:06:25Z","employer_posted_date":"2026-10-11","last_verified_at":"2026-10-21T05:12:24Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"Description\nAbout the Role\nWe are looking for a Threat Hunter to join our Cyber Threat Intelligence function and run proactive, hypothesis-driven hunts across our environment. This is a dedicated hunting role at the front of a detection pipeline: you will turn intelligence and adversary tradecraft into concrete hunts and turn what you find into detection packages that our tooling team operationalizes and our SOC consumes as tuned, documented alerts.\nYou will sit at the intersection of threat intelligence, detection engineering, and offensive validation. Working from CTI and from our red teamer's findings, you will hunt for activity that never trips an existing alert, novel techniques, living-off-the-land tradecraft, misconfiguration abuse, and long-dwell intrusions, and close those gaps by feeding durable detections and configuration fixes back into the organization. It is a role for a curious, methodical hunter who is energized by long-horizon investigation rather than the pace of the alert queue.\nLocation: We are flexible on remote working from home, if you are located in the USA and reside in one of the following states: CA, CO, CT, FL, GA, *IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.\n*Onsite interviews may be required for this role.\nWhat You'll Be Doing\nPlan and run hypothesis-driven hunts (intel-led, TTP-led, and behavior-led) across endpoint, identity, cloud, and network telemetry\nConsume CTI and red-team/purple-team findings to prioritize hunts against the adversary behaviors most relevant to us\nMap hunts and findings to MITRE ATT&CK to track coverage and expose blind spots\nTranslate hunt findings into detection packages and recommendations, including detection logic, required context and enrichment, and draft SOP guidance, for the tooling team to operationalize\nPartner with the red teamer on purple validation of configuration faults and security-posture gaps\nSurface configuration faults and posture gaps discovered during hunts, and drive recommendations to close them\nDocument hypotheses, methods, and outcomes so hunting knowledge lives in reusable artifacts rather than in one person's head\nContribute threat context and hunt-derived intelligence during declared Sev 1 incidents, in an advisory (non-primary) capacity\nOther duties as needed\nRequired Qualifications\n5+ years in a security operations, detection engineering, CTI, or incident response role, with meaningful hands-on threat-hunting responsibility\nDemonstrated experience running hypothesis-driven hunts, forming a hypothesis, testing it against telemetry, and driving it to a conclusion, not solely alert triage\nStrong working knowledge of adversary tactics, techniques, and procedures, and practical fluency with the MITRE ATT&CK framework\nProficiency querying and pivoting across security telemetry at scale in a SIEM and/or EDR/XDR (e.g., KQL, SPL, or equivalent query languages)\nSolid understanding of endpoint, identity, cloud, and network telemetry, and a sense of what normal and abnormal look like in each\nAbility to turn a hunt finding into a detection recommendation, including logic, supporting context, and fidelity/signal-to-noise considerations\nUnderstanding of the detection lifecycle and why signal-to-noise quality matters to a SOC\nClear written communication for documentation, detection packages, and SOP recommendations\nAble to plan and sustain long-horizon hunt campaigns with limited day-to-day direction\nPreferred Qualifications\nExperience consuming red-team or purple-team output to drive and prioritize hunts\nScripting for automation and enrichment (Python preferred)\nFamiliarity with detection-as-code workflows and version-controlled detection content\nDepth in cloud-native and SaaS telemetry (CloudTrail, Entra ID/Azure AD, SaaS audit logs)\nExperience with a threat intelligence platform (TIP) and structured intel workflows\nExposure to an IR-capable or standing-response team environment\nRelevant certifications, one or more (preferred, not required): \nGCTI, GCFA, GCDA, GCIA, or similar GIAC certifications\nOSCP or comparable (for offensive-tradecraft awareness)\nCloud security certifications (AWS, Azure, or GCP), or equivalent\nKey Skills\nAdversary mindset, thinks in behaviors and TTPs, not indicators alone\nPatience and persistence for long-horizon threads that may not pay off immediately\nStrong analytical and data-pivoting skills across large, varied datasets\nTranslates findings into durable, reusable detections and clear documentation\nCommunicates effectively across CTI, tooling, and SOC audiences\nCuriosity and a genuine drive to find what existing alerting misses\nAbout Us\nNinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries. The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work. NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.\nWhat You'll Love\nA collaborative, kind, and curious community\nFull-time work that is hybrid remote, honoring your flexibility needs\nA comprehensive benefits package, including medical, dental, and vision insurance\nA 401(k) plan to help you prepare for your financial future\nUnlimited PTO that prioritizes your work-life balance\nOpportunity for growth and advancement\nAdditional Information\nThis position is NOT eligible for Visa sponsorship. Due to federal government security requirements associated with our FedRAMP-authorized environment, candidates must be U.S. citizens or lawful permanent residents.\nDue to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city proper or are willing to self-relocate.\nStarting pay for the successful applicant depends on a variety of job-related factors, including but not limited to location, market demands, experience, job-related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage, and PTO. For roles based in California, Colorado, Maryland, New Jersey, or Washington, the base salary hiring range for this position is $80,000 to $110,000 per year.\nFor roles based in New York, the base salary hiring range for this position is $80,000 to $110,000 per year.\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.","description_format":"text","description_chars":6999,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Insurance coverage","Life insurance","Unlimited PTO","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["IT Service & Asset Management","RMM & MSP Software","Backup & Disaster Recovery"],"lifecycle":[{"event":"open","at":"2026-10-11T21:06:25Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":3,"green_card_filings_12m":0,"median_offered_wage_usd":192500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":50,"band":"ok","label":"Likely open","p_open":1,"p_active":0.858,"p_room":0.578,"age_days":9,"expected_fill_days":8,"reasons":["conf:0","velocity","win:tail"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":110000,"is_top_pay":false},"html_url":"https://alion.io/job/ninjaone-cyber-threat-hunter","json_url":"https://alion.io/job/ninjaone-cyber-threat-hunter.json","meta":{"generated_at":"2026-10-21T07:53:31Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11230,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":782},"rest":"https://alion.io/mcp/rest/get_company?id=782"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fninjaone-cyber-threat-hunter"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fninjaone-cyber-threat-hunter"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fninjaone-cyber-threat-hunter"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ninjaone-cyber-threat-hunter\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fninjaone-cyber-threat-hunter"}]}