Cyber Threat Hunting Analyst

Location: Houston, TX, United States

Job Summary

The Cyber Threat Hunting Analyst serves as a technical lead for threat hunting, focusing on identifying advanced threats that evade traditional security controls. They design and drive hunt campaigns across endpoint, identity, cloud, email, and DNS/proxy data, and own the conversion of those hunts into durable detection and monitoring improvements. The role also provides guidance and mentorship to other hunters and analysts and represents threat hunting in cross-team detection and response strategy discussions. This is a hands-on role for an analyst with solid SOC/IR or detection experience who enjoys investigative work more than reacting solely to alerts.

Duties and Responsibilities

• Lead complex, proactive threat-hunting investigations across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud platforms, email, DNS and web proxy data to uncover previously undetected threats, attacker techniques and misconfigurations that bypass existing controls
• Own the threat-hunting roadmap and backlog, defining and prioritizing hunt topics and maintaining playbooks and use cases based on threat intelligence, recent campaigns, penetration-test findings and knowledge of the environment
• Establish and refine behavioral baselines for key users, systems and applications, using those baselines to distinguish benign anomalies from meaningful indicators of compromise or abuse during hunts and investigations
• Translate successful hunts and identified patterns into detection content (rules, analytics, scheduled searches, watchlists) and lead the testing and tuning of new or updated detections and models with Detection Engineering to ensure effective, low-noise coverage before production rollout
• Collaborate with CTI analysts, SOC/Incident Response and offensive security/pentesters to operationalize intelligence, expand high-priority investigations and ensure exploited attack paths and high-risk behaviors are visible and monitored going forward.
• Maintain structured documentation of hunt hypotheses, methods, data sources, findings and outcomes; develop and maintain hunt playbooks and reusable queries; and serve as a technical mentor and escalation point for other hunters and analysts.

Qualifications

Education Required:

• Bachelor’s degree in Cybersecurity, Computer Science

Education Preferred:

• Master’s degree in Cybersecurity, Computer Science

Experience Required:

• 6+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.

Experience Preferred:

• 8+ years of experience in roles such as SOC analyst, incident responder, detection engineer, or threat hunter, with demonstrable experience analyzing security telemetry.

Licenses/Certifications Preferred:

• GCDA, GCIH, SC-200

Technical Skills and Abilities:

• Advanced experience leading multi-source threat hunts across EDR, SIEM/log analytics, identity (AD/Azure AD/IdP), cloud, email, DNS and web proxy data.
• Strong proficiency with SIEM / log query languages (e.g., KQL, S1QL) and building complex, ATT&CK-aligned hunting queries and analytics.
• Deep understanding of attacker TTPs and the MITRE ATT&CK framework, especially around credential theft, persistence, lateral movement, command and control, and data exfiltration.
• Proven ability to establish and refine behavioral baselines for users, systems and applications, and to use those baselines to distinguish benign anomalies from meaningful indicators of compromise.
• Experience designing, testing and tuning detections and analytics derived from hunt results, including evaluating false-positive/false-negative trade-offs.
• Strong collaboration skills working with CTI, SOC/Incident Response, penetration testers and detection engineers to operationalize intelligence, expand investigations and validate coverage of attack paths.
• Excellent documentation and communication skills, including producing structured hunt reports, maintaining playbooks and reusable queries, and briefing security leadership on findings and coverage.
• Ability to act as a technical mentor and escalation point for other hunters and analysts, reviewing their hunts and improving analytical rigor and consistency.

Additional Requirements

Language Requirements:

Strong written and verbal communication skills in English are required.

Physical Demands:

Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.

May occasionally be required to support high-priority investigations or coordinated hunts outside of standard business hours.

Travel Requirements:

Minimal travel.

Work Environment:

Hybrid Role based in the Houston office

Decision Making Authority

Decisions to be made independently without direction or supervision:

• Selects hypotheses, data sources, queries and investigative approaches for assigned hunts.
• Determines which anomalies warrant deeper investigation and which can be closed as benign, documenting rationale.
• Prioritizes hunt workload across multiple concurrent hypotheses and campaigns based on risk and available data.
• Proposes new or modified detections and analytics based on hunt results and observed patterns.
• Structures and documents hunt outputs, including timelines, findings and recommended follow-up actions.

Decisions made with review/approval of other individuals/leadership:

• Final selection and deployment of new or significantly changed detections and analytics into production monitoring.
• Changes to hunt roadmap focus that materially affect broader detection strategy or team priorities.
• Recommendations that drive new logging/data collection requirements or significant changes to existing telemetry.
• Escalation of major risks and gaps in coverage to leadership, including proposals for additional resourcing or tooling.