← All roles

Senior Detection Engineering & Threat Hunting Analyst

Huntress· DE&TH
Apply on company site
Remote$150k - $170kFull-timePosted 4w ago

About the role

Senior analyst focusing on detection engineering and threat hunting within Huntress’ 24x7 SOC, turning threat intelligence and hypotheses into detections, building scalable detection portfolios, and proactively hunting for adversary techniques at scale.

Responsibilities

  • Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on their performance.
  • Develop rules across a variety of Huntress products and operating systems, including ITDR, SIEM, EDR, Windows, Linux, and macOS.
  • Manage any DE&TH requests raised internally or escalated from our partners.
  • Undertake hypothesis-driven hunts across Huntress telemetry, prioritizing techniques and tradecraft that may evade high-fidelity detections and initial SOC review.
  • Consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows.
  • Build and refine hunting dashboards or queries required to surface potential intrusions.
  • Review ambiguous signs of attacker activity across Huntress products, and surface likely intrusions that require deeper investigation.
  • Investigate or escalate likely intrusions identified to ensure partners receive clear incident reports with accurate advice.
  • Contribute findings to community-driven projects and create Huntress content such as blogs, social posts, videos, podcasts, and webinars.
  • Use AI-assisted workflows to prototype queries, enrich analysis, and develop a scaffolding for detection rules, applying sound judgment to validate AI output.

Qualifications

  • 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.
  • Intermediate knowledge of Windows internals.
  • Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.
  • Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations.
  • Ability to communicate findings through clear written reports.
  • Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL.
  • Understanding of adversary tradecraft (persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection).
  • Understanding of various threat actor roles and goals (e.g., initial access brokers, ransomware affiliates, state-sponsored entities).
  • Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and verify AI outputs before production.

Skills

Required:Detection rule developmentWindows internalsLinux/macOS proficiencyDetection languagesQuery languages

Benefits

  • 100% remote work environment
  • Generous paid time off (vacation, sick time, holidays)
  • 12 weeks of paid parental leave
  • Medical, dental, and vision benefits
  • 401(k) with a 5% employer contribution
  • Life and Disability insurance
  • Stock options for all full-time employees
  • One-time $500 home office reimbursement
  • Annual education and professional development allowance
  • $75 USD/month digital reimbursement
  • Access to BetterUp coaching platform
Last updated Oct 22, 2026. Interested? Apply on the company site.

About Huntress

Enterprise-grade cybersecurity for ALL businesses.

Stop cyberattacks with the Huntress Managed Platform. Get 24/7 SOC-backed EDR, ITDR, SIEM, & Security Awareness Training for enterprise-grade protection across all your environments

cybersecurityendpoint protectionEDRITDRSIEMSecurity Awareness Training
Company profileWebsite

More open roles at Huntress