CYBER THREAT HUNTING MANAGER

The Threat Hunting Manager is responsible for ensuring JTI has a strong, proactive threat detection and threat hunting capability across both on-premise and cloud environments. The role is accountable for the effectiveness of detection and hunting outcomes, achieved by orchestrating a managed security service provider (MSSP) and a small internal technical team as a single, high-performing function. This position focuses exclusively on Threat Detection and Threat Hunting. While it does not own Incident Response, Cyber Threat Intelligence, or Vulnerability Management, the role works closely with these teams to provide early detection insights, validate scope, and identify malicious activity as early as possible. The primary objective is to continuously improve JTI’s ability to detect advanced threats early, reduce attacker dwell time, and scale detection and hunting services enterprise-wide. This includes governance of MSSP performance, technical leadership of the internal team, and close alignment with IT and business stakeholders to ensure detection capabilities reflect JTI’s risk landscape and business priorities. Responsibilities:

• Provide technical leadership, strategic vision, and end-to-end accountability for the organisation’s threat detection and threat hunting capability. This includes orchestrating the Managed Security Service Provider (MSSP) and the internal technical team as a cohesive operating model, ensuring clear accountability, effective technical execution, and continuous improvement of detection and hunting outcomes across on-premise and cloud environments
• Accountable for the effectiveness and quality of the organisation’s threat detection capability, delivered through both the Managed Security Service Provider (MSSP) and the internal technical team. This includes assessing detection coverage, determining the need for new analytic rules, designing and creating detections from scratch where required, and ensuring existing rules are continuously reviewed, optimised, and maintained to deliver high-fidelity detections, reduce noise, and ensure consistent detection standards and outcomes across all detection providers
• Accountable for the effectiveness and coordination of the organisation’s threat hunting capability, delivered through both the Managed Security Service Provider (MSSP) and the internal technical team. This includes aligning and supervising MSSP-led hunting activities, ensuring hunts are relevant, timely, and risk-driven, while guiding and supporting the internal team in performing advanced, hypothesis-based threat hunting to identify sophisticated or previously undetected threats, and ensuring consistent hunting standards and outcomes across both delivery models
• Accountable for integrating purple team activities into the threat detection and hunting lifecycle. This includes translating adversary simulations, attack scenarios, and identified gaps into actionable detection improvements, ensuring learnings from offensive testing directly enhance analytic rules, hunting hypotheses, and overall detection effectiveness
• Accountable for effective collaboration across Incident Response, Cyber Threat Intelligence, Vulnerability Management, and other security functions to ensure threat detection and hunting activities are aligned with broader security operations. This includes sharing context and insights, supporting investigation and scoping, informing prioritisation, and ensuring detection and hunting outputs meaningfully contribute to response, remediation, and risk reduction efforts

• Degree in Computer Science, Cybersecurity, or a related field (or equivalent experience)
• 5-7+ years of experience in security monitoring, alert triage, and threat hunting
• Hands-on experience with SIEM, XDR, and other security platforms
• Experience supporting large, global organizations in hybrid environments
• Background in incident response, threat intelligence, or related security operations

Skills & Competencies:

• Strong analytical and problem-solving skills
• Ability to interpret complex security signals and drive clear outcomes
• Experience with change management and continuous improvement
• Excellent communication and presentation skills
• Strong ownership, accountability, and sense of urgency
• Knowledge of frameworks such as MITRE ATT&CK, Cyber Kill Chain, and Diamond Model
• Experience with EDR, identity protection, network, and cloud security technologies
• Understanding of threat actors and their tactics, techniques, and objectives
• Innovative, curious, and solution-oriented mindset
• Customer service-oriented attitude