Senior Detection Engineering, Threat Hunting Analyst

This is a fully remote position, open to applicants in Australia.

📋 Description

• Participate in every stage of the detection lifecycle by formulating new rules, conducting tests prior to deployment, monitoring effectiveness, and adjusting, promoting, or retiring rules based on their performance.

• Create rules for Huntress products and various operating systems, including ITDR, SIEM, EDR, Windows, Linux, and MacOS.

• Oversee DE&TH requests that are raised internally or escalated from partners.

• Execute hypothesis-driven hunts using Huntress telemetry to uncover techniques and tradecraft that may bypass detections and initial SOC evaluations.

• Analyze threat intelligence and convert IOCs, TTPs, and internal discoveries into detections through Git-based workflows.

• Develop and enhance hunting dashboards or queries to reveal potential intrusions.

• Examine ambiguous attacker activities and highlight probable intrusions that warrant further investigation.

• Investigate or escalate potential intrusions to ensure partners receive comprehensive incident reports and precise recommendations.

• Contribute insights to community-led initiatives and produce blogs, social media content, videos, podcasts, and webinars.

• Utilize AI-assisted workflows to prototype queries, enhance analyses, and construct detection-rule frameworks while validating AI outputs.

• Collaborate with the 24x7 Security Operations Center, Adversary Tactics & Tactical Response, engineering, and related teams.

⛳️ Requirements

• Minimum of 2 years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.

• Intermediate understanding of Windows internals.

• Proficient knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.

• Proven experience in developing, testing, tuning, and documenting detections or analytics derived from threat intelligence, IOCs, hypotheses, or real-world investigations.

• Capable of articulating findings through clear written reports.

• Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, along with query languages like KQL, EQL, ES|QL, or Splunk SPL.

• Solid understanding of adversary tradecraft, including techniques for persistence, privilege escalation, defense evasion, lateral movement, discovery, and data collection on systems.

• Deep understanding of the roles different threat actors play and their corresponding objectives, including initial access brokers, ransomware affiliates, and state-sponsored groups.

• Proficient in orchestrating reusable AI workflows that enhance threat hunting, detection development, or analysis, and capable of validating AI-generated outputs prior to deployment in production environments.

• Bonus points for intermediate knowledge of Linux and MacOS internals, practical experience with OSquery, Velociraptor, EDR/MDR/XDR platforms, forensic tools, and intermediate malware analysis skills.

🏝️ Benefits

• Fully remote work

• At least one annual trip to the US for Summer Summit, along with additional local events in Australia!

• New starter home office setup reimbursement ($800 AUD)

• 12 weeks of paid parental leave for both primary and secondary caregivers

• Monthly digital allowance for personal phone and internet expenses ($185 AUD)

• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)

• Subsidized private health insurance through our preferred provider

• Stock options available for all full-time employees

• Access to the BetterUp platform for coaching and personal and professional development