AI Cyber Threat Hunter

Cyber Defense Team is seeking an advanced Cyber Threat Hunter to proactively identify sophisticated adversaries lurking within our network. You will leverage AI/ML algorithms to sift through massive datasets, identifying anomalies, weak signals, and malicious activities that evade standard automated defenses. The role involves rapid pivoting through data, conducting deep-dive forensics, and partnering with detection engineers to turn hunts into automated detection rules. Responsibilities:

• Proactive Hunting: Conduct advanced, hypothesis-driven threat hunting campaigns to uncover hidden malicious activity, utilizing AI-based behavioral analytics.
• AI/ML Integration: Apply machine learning models and data science techniques to analyze large-scale security telemetry (logs, endpoint, network, cloud) to surface anomalous patterns.
• Adversary Simulation: Analyze emerging threat actor tactics, techniques, and procedures (TTPs) using threat intelligence to guide hunts.
• Detection Engineering: Work closely with engineering teams to convert manual investigative findings into durable SIEM alerts and automated detections.
• Forensics & Analysis: Perform deep-dive analysis of malware and indicators of compromise (IOCs), reverse-engineering exploits to understand scope and impact.
• Documentation: Meticulously document hunt approaches, findings, and actionable insights to improve long-term resilience.

• Experience: 5+ years in cybersecurity, with at least 3 years specifically in threat hunting or incident response.
• AI/ML Knowledge: Demonstrated experience applying machine learning or statistical analysis to cybersecurity data.
• Scripting: Proficient in Python for parsing logs, data correlation, and automation (PowerShell/Bash a plus).
• Technology Stack: Strong understanding of SIEM platforms, EDR tools, network traffic analysis, and cloud environments (AWS/Azure).
• Analytical Skills: Ability to analyze large, disparate datasets and pivot through forensic trails.

Preferred Skills & Qualifications:

• Certifications: Active GCIH, GCDA, GCTI, or similar advanced security certifications preferred.