> Markdown version of [/jobs/ext/1355246-cyber-threat-hunter](https://www.wearedevelopers.com/jobs/ext/1355246-cyber-threat-hunter). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Hunter

- **Company:** Ing's Global Threat Management
- **Location:** Madrid, Spain (Remote available)
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing Security, Continuous Integration, Intrusion Detection and Prevention, Mitre Att&ck, Multi-Cloud, Cybercrime
- **Published:** July 20, 2026
- **Apply:** https://www.adzuna.es/contact-us.html

## About the Role

+ Several years of hands-on experience in hypothesis-based threat hunting activities, purple teaming or security research.
 + Experience with threat hunting methodologies, such as TaHiTi, PEAK, or others.
 + Proven experience in large enterprise environments, with technologies such as CI/CD, multi-cloud and containers.
 + Ability to translate threat intelligence into concrete, high-impact investigations.
 + Skill in identifying and validating meaningful security gaps rather than chasing alerts or noise.
 + Capacity to think and reason like an adversary while emulating attack scenarios.
 + Ability to deliver investigation outcomes that improve detection, controls, or resilience.
 + Clear communication of complex threats to both technical and non-technical stakeholders.
 + Ability to work effectively in an environment with ambiguity, autonomy, and high trust.
You'll get extra points for:

 + Experience or relevant certifications in cyber threat hunting, detection engineering, or adversary simulation (e.g., GIAC, MITRE ATT&CK, cloud security, or BAS-related certifications) are considered an advantage.

## Description

Are you driven by curiosity and motivated to stay ahead of cyber adversaries?
As a Senior Cyber Threat Hunter, you will proactively uncover advanced and hidden threats before they become incidents. You will think like an attacker, challenge assumptions, and help strengthen ING's resilience against evolving cyber risks.
The team
You will join ING's Global Threat Management (GTM) team, a central capability within the CISO domain that focuses on intelligence-driven, proactive defence.
The team works across geographies and disciplines to anticipate emerging threats, investigate advanced attack scenarios, and continuously improve ING's detection and defensive posture. Collaboration, communication, ownership, and impact are core to how we work., + Proactively conduct intelligence-led threat hunting and emulation based on emerging threats, adversary activity, and major external cyber incidents.

 + Develop and test hypothesis-driven investigations to identify unknown or evasive malicious activity.
 + Analyse adversary behaviour across the full attack chain, identifying detection and control gaps.
 + Translate hunt outcomes into actionable improvements for detection, prevention, and defensive architecture.
 + Map findings to MITRE ATT&CK to clearly articulate threats, gaps, and priorities.
 + Communicate investigation outcomes in clear, executive-ready reports that supportrisk-based decision-making.
 + Leverage automation, AI-assisted analytics, and Breach & Attack Simulation (BAS) to continuously validate threat hypotheses, test adversary techniques, and prioritise high-risk attack paths.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Leverage Cloud Computing Benefits with Serverless Multi-Cloud ML ](https://www.wearedevelopers.com/videos/78-leverage-cloud-computing-benefits-with-serverless-multi-cloud-ml)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Winning the Hybrid Cloud](https://www.wearedevelopers.com/videos/432-winning-the-hybrid-cloud)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)