Senior Cyber Threat Hunter

Job description

JOB DESCRIPTION

Experian, a global leader in providing information solutions to organizations and consumers, is seeking a highly motivated Senior Cyber Threat Hunter to join our Cyber Fusion Center (CFC) team as a fully remote position located in India.

RESPONSIBILITIES

As a member of Experian’s Global Security Office (EGSO) this individual will research and investigate hosts and networks to identify adversary tools, techniques, and procedures (TTPs), investigate potential exploitation of systems, and provided reactive investigate support during security incidents to identify adversary behavior elsewhere in the environment. They will also be expected to participate in several different areas within Security Operations and Incident Response process; these activities may include malware reversing, digital forensics, use case development, security control testing, and hunt plan development. The candidate for this role must have strong personal skills involving report writing, presentation, organization, and communication.

This is a technical position supporting the strategies of the Global Security Operations Center and Experian’s Chief Information Security Officer.  This position reports directly to the Senior Manager, Cyber Threat Hunting as part of the CFC’s Incident Response program.

KEY RESPONSIBILITIES INCLUDE

·       Develop and execute comprehensive threat hunting plans based on intelligence gathered from various sources. Ensure flexibility to adapt strategies to evolving cyber threats and attack vectors.

·       Develop and refine advanced hunt queries and actionable detections that will drive CFC Threat Detection Engineering use cases contributing to continuous improvement of proactive identification and response to evolving security threats.

·       Develop and maintain a repository of SOPs, playbooks, and checklists for hunting that aligns to MITRE ATT&CK TTP Hunting Framework. Ensure comprehensive documentation of threat hunting process, methodologies, queries, and findings for reference including scope, impact, and recommended actions for each finding.

·       Participate in adversary simulation purple team exercises to validate and improve the team’s ability to hunt sophisticated threats.

·       Conduct expert-level hunting using SIEM, UEBA, EDR, and NDR tools, leveraging host, network, and cloud forensic artifacts at scale to confirm threats.

·       Collaborate with incident response, forensics, detection engineering and insider risk teams to share insights, assist in remediation, and drive continuous improvement.

·       Integrate AI/ML models into hunting workflows to enhance anomaly detection, behavioral analytics, and predictive threat hunting.

·       Develop automated hunting workflows and playbooks using SOAR platforms and scripting to scale hunting operations and reduce repetitive tasks.

·       Establish and maintain a dedicated hunt lab environment for hypothesis testing, adversary simulation, and validation of detection coverage.

·       Conduct proactive hunts across hybrid and multi-cloud environments (AWS, Azure, GCP), adapting strategies for containerized workloads, serverless computing, and IoT/OT systems.

·       Define and track KPIs and success metrics for hunting activities, reporting outcomes and recommendations to leadership.

·       Mentor junior hunters and analysts, fostering a culture of curiosity, innovation, and continuous improvement.

JOB REQUIREMENTS

·       5+ years of experience in a technical cybersecurity role with focus in one or more of the following areas: Threat Hunting, Incident Response, Forensics or Red Teaming

·       A bachelor’s or advanced degree in a relevant field such as cybersecurity, computer science, or information technology.

·       Certifications such as GIAC Certified Forensic Analyst (GCFA), GIAC Cloud Forensics Responder (GCFR), GIAC Network Forensic Analyst (GNFA), GIAC Incident Handler (GCIH), EC-Council Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), or equivalent are highly beneficial.

·       Cloud security certifications (AWS Security Specialty, Azure Security Engineer, GCP Professional Cloud Security Engineer) preferred.

·       In-depth knowledge of developing hunt hypotheses and writing hunt queries using cybersecurity technologies, tools, and techniques including SIEM, EDR, NDR, UEBA, forensic tools, and SOAR platforms.

·       Strong analytical and problem-solving skills to interpret complex data and identify potential security threats.

·       Proficiency in using host, cloud, and network forensic artifacts to conduct thorough investigations at scale.

·       Working knowledge of the Cyber Kill Chain Model and MITRE ATT&CK Matrix and how each methodology can be applied to threat hunting.

·       Experience applying AI/ML techniques to anomaly detection, behavioral analytics, and predictive hunting.

·       Effective communication skills to articulate findings, present reports to leadership, and collaborate with cross-functional teams.

·       Experience with at least one common scripting or programming language, such as Python, PowerShell, Go, or JavaScript.

·       Proficiency in developing and implementing Yara, Sigma, and custom detection rules to enhance threat hunting efforts.

·       Demonstrated ability to mentor junior team members and lead cross-functional hunt sprints.