Threat Hunting Lead

About the role

We are looking for a Threat Hunting Lead to join the security operations team of a large US consumer lender in the financial services sector. You will own the hunt plan, lead intelligence‑driven hunts across multiple telemetry sources, and ensure every successful hunt translates into a working detection.

Key responsibilities

• Develop and prioritize hunt hypotheses based on threat intel, recent incidents, and telemetry gaps.
• Execute scheduled and ad‑hoc hunts across CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic.
• Translate hunt outcomes into detection backlog items and present findings to client security leadership.
• Direct and mentor two Senior Threat Hunters, reviewing their work and guiding hypothesis design.

Required profile

• 4+ years of experience in threat hunting, Tier 3 investigation or incident response with end‑to‑end hunt delivery.
• Fluent in SIEM or data‑platform querying (Elastic, Splunk, Sentinel or equivalent) over large data sets.
• Strong MITRE ATT&CK knowledge and ability to spot living‑off‑the‑land, credential abuse and lateral movement in logs.
• Proven experience leading or mentoring analysts and presenting to senior security stakeholders.
• Hypothesis‑driven mindset, candid communication, and English proficiency at B2 level or higher.

Required skills

• Elastic Security (EQL, ES|QL), Splunk, Microsoft Sentinel.
• CrowdStrike Falcon, Microsoft Defender, SentinelOne, Okta.
• Palo Alto Networks, Proofpoint, AWS telemetry.
• MITRE ATT&CK, MISP, OpenCTI, Recorded Future, FS‑ISAC.
• Python, Jupyter notebooks.

What we offer

• Competitive base salary.
• Flexible work model – hybrid, remote or on‑site.
• Real growth opportunities with visibility to leadership.
• Inclusive, people‑first culture blending U.S. innovation with Colombian heart.