Lead Threat Hunter

This is a fully remote position, open to applicants in United States.

📋 Description

• Drive hypothesis-driven, intelligence-led threat hunting initiatives across enterprise, cloud, and OT/IoT settings.

• Design and implement tailored analytics utilizing SIEM, EDR/XDR, identity, cloud, and network telemetry.

• Investigate identity, cloud, AI/LLM, adversary, and deception-related threats.

• Transform hunt discoveries into reliable detections, signatures, and SOAR playbooks.

• Leverage AI and LLM-assisted tools for query creation, log summarization, entity pivoting, anomaly clustering, and pattern identification.

• Generate post-hunt reports that include evidence and quantifiable exposure-reduction results.

• Collaborate with Threat Intelligence to incorporate intelligence into hunt operations and data collection needs.

• Assist in purple team exercises and assess detection effectiveness through adversary emulation campaigns.

• Create and sustain custom tools and automation to enhance hunting, investigation, and analyst productivity.

• Guide junior hunters and contribute to knowledge bases, hunt libraries, and training initiatives.

• Provide support for Incident Response, Forensics, and Insider Threat/Fraud investigations as a senior technical expert.

• Collaborate across Cyber Operations and relay findings to technical colleagues and executive leadership.

• Identify telemetry deficiencies and work with engineering teams to enhance data collection coverage.

• Formulate behavioral, anomaly-based, and baseline-deviation hunting approaches.

⛳️ Requirements

• Over 7 years of experience in security operations, with a minimum of 4 years focused on threat hunting.

• Extensive experience in hunting within large, intricate enterprise environments.

• Proven track record of executing MITRE ATT&CK-aligned hunts with documented results and detection transitions.

• Practical experience with contemporary SIEM platforms such as Splunk, Sentinel, and Elastic.

• Hands-on experience with EDR/XDR platforms including CrowdStrike, Defender, SentinelOne, and Tanium.

• Familiarity with AI/LLM-assisted tools for hunting, triage, and analytic development.

• Working knowledge of MITRE ATLAS, OWASP Top 10 for LLM Applications, and AI-specific threats.

• Understanding of the Diamond Model, Kill Chain, and Pyramid of Pain frameworks.

• Proficient scripting and automation abilities in Python, PowerShell, Go, and/or Bash.

• Knowledge of TCP/IP, DNS, TLS, HTTP, SMTP, and common network/application protocols.

• Experience with CQL/KQL/SPL analytics, Sigma, YARA, Snort, and Suricata.

• Strong analytical, problem-solving, written, and verbal communication skills.

• Proven ability to lead and mentor others.

• Capacity to independently learn new technologies and methodologies.

• Demonstrated ownership of comprehensive hunting programs.

• Background investigation required.

• Allstate typically does not sponsor individuals for employment-based visas for this role.

• A dedicated private workspace and reliable internet with minimum speeds of 50 MB download and 5 MB upload are required for remote work.

• Preferred qualifications include cloud hunting, adversary emulation, malware analysis, AI/ML security, vulnerability research, container/Kubernetes security, deception technology, insider threat or fraud hunting, OT/ICS or IoT knowledge, relevant security certifications, and contributions to published research or open-source detection.

🏝️ Benefits

• Comprehensive technology setup including laptop, monitors, headset, keyboard, and mouse.

• Monthly connectivity reimbursement for employees eligible to work remotely.

• Fully remote work arrangement.

• Opportunities for professional growth and skill enhancement.

• Interview accommodations available upon request.