Threat Hunter

Key Responsibilities

• Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts. 
• Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections. 
• Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content. 
• Utilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats.  
• Support the mapping of threat models to monitoring use cases in partnership with teams across the business. 
• Document and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling. 
• Provide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact. 

Skills, Knowledge & Expertise

• The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration.  
• They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions.  
• Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks. 
• Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings.  
• They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments—including hybrid or cloud-native architectures like AWS, Azure, or GCP.  
• They will be comfortable presenting findings to stakeholders and documenting methodologies. 
• They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.

• Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team role.  
• Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation. 
• Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies. 
• Ability to work autonomously while collaborating across security, engineering, and business teams. 
• Strong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell).