careers
Threat Hunter
Assume they are already inside, and go find the evidence.
A threat hunter searches telemetry for attacker activity that automated detections missed. Each hunt starts from a hypothesis, uses data and queries to test it, and ends with a finding or a documented gap, and with a new detection. It is investigative, analytical work.
see this path on the journey mapA day in the job
- Form hypotheses from threat intelligence, recent incidents and gaps in detection coverage.
- Query large volumes of telemetry and baseline what is normal before flagging what is rare.
- Escalate confirmed findings to incident response with the evidence collected.
- Turn each hunt into an automated detection and measure its false positives.
Stage 1· Foundations
Understand adversary behavior and the response process hunts feed.
Study here
Learn elsewhere
- How operating systems and networks behave normally
- The MITRE ATT&CK framework in depth
Build this
Map five ATT&CK techniques to the log sources that would reveal them in your environment, and mark the gaps.
Stage 2· Practitioner
Build timelines and pivot across data sources.
Study here
Learn elsewhere
- SQL and the query language of your SIEM
- Basic statistics: baselines and outliers
Build this
Write three queries that surface suspicious behavior in a sample dataset and document the false positives.
Stage 3· Advanced
Run hunts end to end and measure the program.
Study here
Learn elsewhere
- Data engineering for telemetry at scale
- Notebooks and automation for repeatable hunts
Build this
Run a hunt against an emulated technique, write the detection it produced and report the coverage gained.
What to show
- A hunt report: hypothesis, data, queries, results and the detection you shipped.
- A coverage map of techniques versus detections, with the gaps ranked.
Certifications (examples)
- GCTI (GIAC)
- GCFA (GIAC)
- eCTHP (INE)
Examples, not endorsements or requirements. Check the issuer for current details.