Cyber Threat Hunter (Cybersecurity)

Location: Remote from home within the USA for residents of CA, CO, CT, FL, GA, IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA; hybrid options are available from offices in Austin, Texas, or Tampa, Florida. Onsite interviews may be required. hirify.global cannot hire within the city limits of Chicago unless the candidate resides outside the city proper or is willing to self-relocate.

Base salary: $80,000–$110,000 USD annually for roles based in California, Colorado, Maryland, New Jersey, Washington, or New York.

Company

hirify.global provides a unified IT operations platform for endpoint management, patching, backup, and remote access, serving nearly 40,000 customers in more than 140 countries.

What you will do

• Plan and execute intelligence-led, TTP-led, and behavior-led threat hunts across endpoint, identity, cloud, and network telemetry.
• Use cyber threat intelligence and red-team or purple-team findings to prioritize hunts and investigate novel techniques, living-off-the-land activity, misconfiguration abuse, and long-dwell intrusions.
• Map hunts and findings to MITRE ATT&CK to measure coverage and identify detection blind spots.
• Turn findings into detection packages containing logic, context, enrichment, and SOP guidance for the tooling team and SOC.
• Partner with red-team functions to validate configuration and security-posture gaps and drive remediation recommendations.
• Document hypotheses, methods, outcomes, and reusable hunt knowledge; provide advisory threat context during declared Sev 1 incidents.

Requirements

• 5+ years in security operations, detection engineering, cyber threat intelligence, or incident response, including meaningful hands-on threat-hunting experience.
• Demonstrated ability to run hypothesis-driven hunts from hypothesis formation through telemetry testing and conclusion, rather than focusing solely on alert triage.
• Strong working knowledge of adversary tactics, techniques, and procedures and practical fluency with the MITRE ATT&CK framework.
• Proficiency querying and pivoting across security telemetry at scale in a SIEM and/or EDR/XDR using KQL, SPL, or equivalent query languages.
• Solid understanding of endpoint, identity, cloud, and network telemetry, including the ability to distinguish normal from abnormal activity.
• Ability to convert hunt findings into detection recommendations with logic, supporting context, and signal-to-noise considerations.
• Understanding of the detection lifecycle and the importance of signal quality to a SOC.
• Clear written communication for documentation, detection packages, and SOP recommendations.
• Ability to plan and sustain long-horizon hunt campaigns with limited day-to-day direction.
• Candidates must be U.S. citizens or lawful permanent residents; visa sponsorship is not available.

Nice to have

• Experience using red-team or purple-team output to prioritize hunts.
• Scripting for automation and enrichment, preferably Python.
• Familiarity with detection-as-code workflows and version-controlled detection content.
• Experience with cloud-native and SaaS telemetry such as CloudTrail, Entra ID/Azure AD, and SaaS audit logs.
• Experience with a threat intelligence platform and structured intelligence workflows.
• Exposure to an incident-response-capable or standing-response team environment.
• Relevant certifications such as GCTI, GCFA, GCDA, GCIA, OSCP, or cloud security certifications.

Culture & Benefits

• Collaborative, kind, and curious work environment.
• Full-time hybrid-remote work with flexibility for eligible U.S.-based employees.
• Medical, dental, and vision insurance, life insurance, and a 401(k) plan.
• Unlimited paid time off and support for work-life balance.
• Opportunities for professional growth and advancement.