> Markdown version of [/jobs/ext/2706687-cyber-security-threat-hunter](https://www.wearedevelopers.com/jobs/ext/2706687-cyber-security-threat-hunter). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Security Threat Hunter - **Company:** Proactive Appointments - **Location:** United States (Remote available) - **Contract:** Permanent contract - **Skills:** Query Performance, Microsoft Windows, Active Directory, User Authentication, Microsoft Azure, Big Data, Cloud Computing, Cloud Computing Security, Digital Forensics, Intrusion Detection and Prevention, Kerberos (Protocol), NT LAN Manager, OAuth, Parsing, Windows PowerShell, Red Team (Cyber Security), Kusto Query Language, Microsoft SharePoint, Security Information and Event Management, Cyber Threat Analysis, Windows Security - **Published:** September 4, 2026 - **Apply:** https://computerjobs.com/us/en/mob/job/35CF495F55B38C2D6A ## About the Role * Incident response processes/methodologies and SIEM operations * Security tooling, reporting, and delivering work in a structured/project-based way * IT/networking/security fundamentals including operating systems, networking and digital forensics * Microsoft Azure and Microsoft 365 cloud technologies * Threat intelligence-driven hunting: Demonstrated use of threat intelligence to plan hunts, enrich detections, and block malicious infrastructure * Windows and identity fundamentals: Strong understanding of Windows security concepts and Microsoft identity (Active Directory and Entra ID), including authentication and token flows (Kerberos/NTLM/OAuth), device join states, MFA/Conditional Access concepts, and common identity attack paths * Endpoint telemetry literacy: Ability to interpret process trees and command lines, PowerShell activity, scheduled tasks/services, registry and file changes, WMI usage, persistence techniques, and LOLBins and to connect these artifacts to Defender alerts and timelines * Microsoft 365 and cloud security foundations: Familiarity with email security and message flow (Exchange Online), and investigation pivots across SharePoint/OneDrive/Teams activity and Azure logs where relevant to XDR incidents * Detection engineering mindset: Experience translating hunts and red team findings into practical detections and improvements (signal selection, tuning, suppression/thresholding, entity mapping, documentation, and operational handoff) * KQL depth and query performance: Comfortable using joins/unions, parsing, time-windowing, summarisation, Essential baselining, and performance-aware query patterns for large datasets ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Tips and Tricks for Working with JSON](https://www.wearedevelopers.com/videos/1229-tips-and-tricks-for-working-with-json) - [Alibaba Big Data and Machine Learning Technology](https://www.wearedevelopers.com/videos/37-alibaba-big-data-and-machine-learning-technology) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)