> Markdown version of [/jobs/ext/2015587-principal-threat-hunting-engineer](https://www.wearedevelopers.com/jobs/ext/2015587-principal-threat-hunting-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Principal Threat Hunting Engineer

- **Company:** Responsibility House
- **Location:** Chantilly, VA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cloud Engineering, Cyber Security, Emulators, Intrusion Detection and Prevention, Cybercrime, Purple Team (Cyber Security)
- **Published:** August 10, 2026
- **Apply:** https://careersingovernment.com/job/2429773/principal-threat-hunting-engineer-17/

## About the Role

Proactively defending Elastic's products and services, the full-time Principal Threat Hunting and Emulation Engineer will lead structured threat hunting operations, design adversary emulation exercises, and collaborate with cross-functional teams to enhance detection capabilities in a remote environment.Key responsibilitiesLead hypothesis-driven threat hunting operations across various environments using established frameworksDesign and execute adversary emulation exercises to validate detection pipelines and identify coverage gapsTranslate findings from hunts into production-ready detections, ensuring collaboration with Detection EngineeringRequired qualificationsAt least 8 years of experience in information security, focusing on threat hunting and detection engineeringDemonstrated experience conducting structured threat hunts in complex enterprise or cloud-native environmentsFamiliarity with threat hunting frameworks such as PEAK and TaHiTIExperience designing and executing adversary
emulation exercises or purple team engagementsWorking knowledge of adversary TTPs and ability to map threat intelligence to hunt hypotheses

Proactively defending Elastic's products and services, the full-time Principal Threat Hunting and Emulation Engineer will lead structured threat hunting operations, design adversary emulation exercises, and collaborate with cross-functional teams to enhance detection capabilities in a remote environment.Key responsibilitiesLead hypothesis-driven threat hunting operations across various environments using established frameworksDesign and execute adversary emulation exercises to validate detection pipelines and identify coverage gapsTranslate findings from hunts into production-ready detections, ensuring collaboration with Detection EngineeringRequired qualificationsAt least 8 years of experience in information security, focusing on threat hunting and detection engineeringDemonstrated experience conducting structured threat hunts in complex enterprise or cloud-native environmentsFamiliarity with threat hunting frameworks such as PEAK and TaHiTIExperience designing and executing adversary
emulation exercises or purple team engagementsWorking knowledge of adversary TTPs and ability to map threat intelligence to hunt hypotheses



## Related Videos

- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [The 12 Best Jobs for Software Engineers](https://www.wearedevelopers.com/magazine/401-the-12-best-jobs-for-software-engineers)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)