Threat Hunter

Deepwatch is seeking a motivated and analytically driven Junior Threat Hunter to join our Security Operations team. You will work alongside experienced hunters, threat intelligence, threat research and incident responders to identify advanced threats that evade traditional controls. This role offers hands-on exposure to enterprise telemetry, detection engineering, and real-world adversary tradecraft.

Key Responsibilities:

• Assist in proactive, hypothesis-driven threat hunts across endpoint, network, cloud, and identity environments.
• Analyze telemetry from EDR, SIEM, NDR, email, and identity platforms.
• Investigate suspicious activity and anomalies to determine malicious vs. benign behavior.
• Support development and tuning of detection rules and analytics.
• Leverage the MITRE ATT&CK framework to understand and map adversary techniques.
• Document hunt findings, methodologies, and lessons learned.
• Collaborate with SOC and Incident Response teams to escalate validated threats.
• Contribute to continuous improvement of detection coverage and hunting playbooks.
• Stay current on emerging threats, malware trends, and attacker techniques.

Required Qualifications:

• 4+ years in cybersecurity with at least 2 years in threat hunting, advanced detection engineering, or incident response.
• Strong experience with EDR platforms (CrowdStrike, Microsoft Defender, SentinelOne, etc.).
• Proficiency in SIEM platforms (Splunk, Sentinel, Elastic, QRadar, etc.).
• Experience writing advanced queries (KQL, SPL, SQL, Lucene, etc.).
• Deep understanding of Windows, Linux, and Active Directory internals.
• Strong knowledge of Cloud services (AWS, Azure, Google Cloud, etc.)
• Familiarity with MITRE ATT&CK framework.
• Experience analyzing process trees, command-line artifacts, persistence mechanisms, and lateral movement.
• Strong knowledge of networking fundamentals and common attack techniques.
• Ability to independently conduct investigations from hypothesis to conclusion.
• Strong written and verbal communication skills.

Preferred Qualifications

• Knowledge of identity-based attacks (OAuth abuse, token theft, Kerberos abuse).
• Experience with scripting (Python, PowerShell, Bash).
• Background in detection engineering or purple teaming.
• Industry certifications such as GCFA, GCIA, GCIH, GCED, CISSP, or similar.
• Experience working in an MDR or MSSP environment.

What Success Looks Like in This Role:

• Identifies previously undetected threats and improves overall detection posture.
• Develops repeatable, scalable hunting methodologies.
• Enhances detection content based on hunt findings.
• Communicates findings clearly to both technical and executive stakeholders.
• Contributes meaningfully to continuous improvement of security operations.

Statutory Pay Disclosure

The anticipated salary range for this role is $94,500 - $118,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States;
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.