Lead Threat Hunter

CyberProof is seeking a Lead Threat Hunter with strong expertise in Python, Jupyter Notebooks, and threat hunting automation to proactively identify advanced threats across enterprise environments. This role combines threat hunting, detection engineering, investigation, data analysis, and automation to enhance security monitoring capabilities across endpoint, network, cloud, and SIEM platforms.

Key Responsibilities

Conduct proactive, hypothesis-driven threat hunts aligned to MITRE ATT&CK.

Investigate security threats across endpoint, network, cloud, and telemetry datasets.

Develop and maintain Jupyter Notebook-based hunting frameworks.

Build reusable Python modules, APIs, and automation tools for threat hunting and data enrichment.

Integrate hunting workflows with SIEM, EDR, threat intelligence, and telemetry sources.

Automate hunting processes using orchestration platforms such as Azure ML Pipelines.

Analyze cloud environments including AWS, Azure, and GCP for indicators of compromise.

Collaborate with Threat Intelligence, Detection Engineering, and SOC teams to identify detection gaps.

Produce weekly, monthly, and executive-level threat hunting reports and findings.

Required Skills

Threat Hunting & Security

Threat Hunting and Incident Response

Detection Engineering

Digital Forensics and Investigations

MITRE ATT&CK Framework

Threat Intelligence and TTP Analysis

Security Monitoring and Log Analysis

Technical Skills

Python Development

Jupyter Notebooks

Pandas, MsticPy

API Development and Automation

Data Pipelines and Data Enrichment

Network Traffic and Packet Analysis

Security Platforms

SIEM Platforms

EDR/XDR Technologies

Microsoft Sentinel

Microsoft Defender

CrowdStrike

Cybereason (preferred)

Cloud Security

• Azure Security
• AWS Security
• GCP Security
• Cloud Threat Hunting

Operating Systems

• Windows Security
• Linux/Unix Security

Preferred Qualifications

• GIAC GCIH
• GCFA
• GREM
• OSCP
• CEH
• Experience with CI/CD and modern software development practices
• Experience building automation frameworks for detection validation and telemetry analysis