Senior Detection Engineering & Threat Hunting Analyst

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organisations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Centre (SOC).

As a Senior Detection Engineering and Threat Hunting (DE&TH) Analyst you will be part of a team that wakes up every morning with the honour of impeding threat actors through a combination of detection engineering and threat hunting. This team sits alongside our 24x7 Security Operations Centre, and our Adversary Tactics & Tactical Response function, and plays a pivotal role in detecting threats actors before they get a chance to impact our partner environments.

You will turn threat intelligence, or a hypothesis, into detections that help the SOC find real intrusions faster. You will design, build, and maintain a resilient, scalable, and high-fidelity detection portfolio that enables the SOC to rapidly identify and respond to adversary activity.

Responsibilities:

• Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on their performance.
• Develop rules across a variety of Huntress products and operating systems such as: Identity Threat Detection and Response (ITDR), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Windows, Linux, and MacOS.
• Manage any DE&TH requests raised internally or escalated from our partners.
• Undertake hypothesis-driven hunts across Huntress telemetry, prioritising techniques and tradecraft that may evade high-fidelity detections and initial SOC review.
• Consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows.
• Build and refine hunting dashboards or queries required to surface potential intrusions.
• Review ambiguous signs of attacker activity across Huntress products, and surface likely intrusions that require deeper investigation.
• Investigate or escalate likely intrusions identified to ensure partners receive clear incident reports with accurate advice.
• Contribute findings to community-driven projects and create Huntress content such as blogs, social posts, videos, podcasts, and webinars.
• Use AI-assisted workflows to prototype queries, enrich analysis, and develop a scaffolding for detection rules, ensuring you apply sound judgment to validate the AI output.

What You Bring To The Team:

• 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.
• Intermediate knowledge of Windows internals.
• Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.
• Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations.
• Ability to communicate findings through clear written reports.
• Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL.
• A sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system.
• A sound understanding of the roles different threat actors play and their associated goals, such as: initial access brokers, ransomware affiliates, and state-sponsored entities.
• Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments.

What We Offer:

• Fully remote work
• At least one annual trip to the US for Summer Summit, with additional local events in Australia!
• New starter home office set up reimbursement ($800 AUD)
• 12 weeks paid parental leave for both primary and secondary carers
• Monthly digital allowance for personal phone and internet costs ($185 AUD)
• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)
• Subsidised private health insurance through our preferred provider
• Stock options for all full-time employees
• Access to the BetterUp platform for coaching, personal, and professional growth