Threat Hunter

Key Responsibilities

• Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
• Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections.
• Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content.
• Utilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats. 
• Support the mapping of threat models to monitoring use cases in partnership with teams across the business.
• Document and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling.
• Provide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact.

Skills, Knowledge & Expertise

• The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration. 
• They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions. 
• Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks.
• Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings. 
• They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments—including hybrid or cloud-native architectures like AWS, Azure, or GCP. 
• They will be comfortable presenting findings to stakeholders and documenting methodologies.
• They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.

• Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysisor Blue Team role. 
• Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation.
• Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies.
• Ability to work autonomously while collaborating across security, engineering, and business teams.
• Strong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell).

• Hands-on experience using Jupyter Notebooks for data exploration, automation, and visualization in a security context.
• Knowledge of cloud products and log events such as Azure, Amazon Web Services, Google Cloud Platform.  
• Familiarity with data science and machine learning techniques in security analysis.
• Background in building automated hunting pipelines and/or detection-as-code.

• GCFA
• OSCP
• GDAT
• GCIH
• Or similar certifications, not required but certainly desirable.