Cyber Threat Investigator

Role Overview

Responsible for proactively identifying, investigating, and mitigating advanced cyber threats that evade traditional, alert‑driven security controls. The role focuses on hypothesis-driven and intelligence-led threat hunting across endpoint, network, identity, and cloud environments to reduce dwell time and enhance detection maturity.

Key Responsibilities

• Conduct hypothesis-based and IOC-driven threat hunting across:
• Endpoint (EDR/XDR)
• SIEM / Log Management platforms
• Network telemetry (NDR)
• Identity logs (AD / Entra ID)
• Cloud platforms (Azure, AWS, M365)
• Identify stealthy and advanced threats, including:
• Living‑off‑the‑Land (LotL) techniques
• Advanced Persistent Threats (APTs)
• Lateral movement and privilege escalation
• Insider threat indicators
• Develop and execute MITRE ATT&CK–aligned hunting hypotheses
• Convert hunting findings into:
• Security incidents
• New detection rules (SIEM / EDR / XDR)
• Change or service requests (misconfigurations, logging gaps)
• Collaborate with SOC, Incident Response, and Threat Intelligence teams
• Produce hunting reports and KPIs (dwell time reduction, hunts to detections, incidents generated)

Technical Skills

• Strong expertise in SIEM/SOAR platforms (Splunk, Microsoft Sentinel, Chronicle, Palo Alto XSIAM)
• Hands-on experience with EDR/XDR tools (Microsoft XDR, CrowdStrike, SentinelOne, Palo Alto Cortex)
• Proficiency in KQL / SPL / advanced hunting queries
• Deep understanding of MITRE ATT&CK techniques and TTPs
• Strong OS knowledge: Windows, Linux, macOS
• Basic scripting skills (PowerShell / Python preferred)
• Cloud security exposure (Azure, AWS, M365 Defender)

Experience & Soft Skills

• 6+ years in SOC / Threat Detection, with 2+ years in threat hunting
• Strong analytical and investigative mindset
• Client‑facing reporting and presentation skills
• Willingness to work in 24×7 SOC environments