Lead Threat Hunter

Cyber. Proof is seeking a Lead Threat Hunter with strong expertise in Python, Jupyter Notebooks, and threat hunting automation to proactively identify advanced threats across enterprise environments. This role combines threat hunting, detection engineering, investigation, data analysis, and automation to enhance security monitoring capabilities across endpoint, network, cloud, and SIEM platforms.

Key Responsibilities

Conduct proactive, hypothesis-driven threat hunts aligned to MITRE ATT&CK. Investigate security threats across endpoint, network, cloud, and telemetry datasets. Develop and maintain Jupyter Notebook-based hunting frameworks. Build reusable Python modules, APIs, and automation tools for threat hunting and data enrichment.

Integrate hunting workflows with SIEM, EDR, threat intelligence, and telemetry sources. Automate hunting processes using orchestration platforms such as Azure ML Pipelines. Analyze cloud environments including AWS, Azure, and GCP for indicators of compromise. Collaborate with Threat Intelligence, Detection Engineering, and SOC teams to identify detection gaps.

Produce weekly, monthly, and executive-level threat hunting reports and findings.

Required Skills

Threat Hunting & Security Threat Hunting and Incident Response Detection Engineering Digital Forensics and Investigations MITRE ATT&CK Framework Threat Intelligence and TTP Analysis Security Monitoring and Log Analysis Technical Skills Python Development Jupyter Notebooks Pandas, Mstic. Py API Development and Automation Data Pipelines and Data Enrichment Network Traffic and Packet Analysis Security Platforms SIEM Platforms EDR/XDR Technologies Microsoft Sentinel Microsoft Defender Crowd.

Strike Cybereason (preferred) Cloud Security Azure Security AWS Security GCP Security Cloud Threat Hunting Operating Systems Windows Security Linux/Unix Security Preferred Qualifications GIAC GCIH GCFA GREM OSCP CEH Experience with CI/CD and modern software development practices Experience building automation frameworks for detection validation and telemetry analysis