Cyber Threat Investigator

About the role

We are looking for a Cyber Threat Investigator to join our security team and lead advanced threat hunting initiatives. The role focuses on detecting, analyzing, and responding to sophisticated cyber threats across our environment.

Key responsibilities

• Design and execute hypothesis‑driven threat hunts using MITRE ATT&CK framework.
• Develop high‑fidelity detection rules in Splunk Enterprise Security and Splunk UBA.
• Perform endpoint forensics and malware analysis to identify indicators of compromise.
• Apply NIST and SANS guidelines for containment, eradication, and recovery.
• Maintain deep knowledge of Windows internals, network protocols, and authentication mechanisms (AD, Azure AD, Kerberos, NTLM).
• Automate investigations and reporting with PowerShell and Python scripts.

Required profile

• Strong teaching and knowledge‑transfer abilities.
• Excellent communication and self‑directed problem‑solving skills.
• Relevant certifications such as GCTI, GCIH, GCFA, CTIA, SC‑200, Splunk ES Admin, CISSP, CISM, or OSCP are highly valued.

Required skills

• Expertise with Splunk Enterprise Security, SPL, and Splunk UBA.
• Proficiency in MITRE ATT&CK based threat hunting.
• Experience in endpoint forensics and malware analysis.
• Solid understanding of Windows internals, network protocols, AD/Azure AD, Kerberos, NTLM.
• Advanced scripting in PowerShell and Python.