Threat Hunter

About the role

We are seeking a highly capable and hands‑on Threat Hunter to join NCC Group’s industry‑leading cyber services team. The role focuses on proactive, hypothesis‑driven hunting of sophisticated adversaries across customer environments using our proprietary HITS framework.

Key responsibilities

• Use NCC Group’s HITS framework, MITRE ATT&CK, threat intelligence and risk models to form and validate hunting hypotheses.
• Automate hunts and visualise results with GitLab, Sigma, Jupyter Notebooks and create reusable artifacts.
• Collaborate with detection engineers to translate findings into high‑fidelity detection content.
• Leverage internal and open‑source threat intelligence to operationalise detections for emerging threats.
• Document hunting methodologies, tooling and findings in a robust repository.
• Provide regular reports and presentations to stakeholders, articulating threats, methods and risk impact.

Required profile

• Experience in Threat Hunting, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team roles.
• Strong understanding of the MITRE ATT&CK framework, TTP analysis and adversary emulation.
• Proven ability to work autonomously while collaborating across security, engineering and business teams.
• Excellent analytical mindset with curiosity and methodical thinking.
• Strong scripting and query language skills (e.g., Python, KQL, SQL, PowerShell).

Required skills

• MITRE ATT&CK framework
• Splunk, Microsoft, CrowdStrike and SentinelOne SIEM/EDR stacks
• GitLab, Sigma, Jupyter Notebooks
• Python, KQL, SQL, PowerShell
• AWS, Azure, GCP cloud environments

What we offer

• Flexible working options
• 25 days holiday plus bank holidays and the ability to purchase up to 5 extra days
• Medical & Critical Illness Scheme
• Pension, Life Assurance and Share Save Scheme
• Community volunteering programmes
• Green Car and Cycle‑to‑Work schemes
• Special time off for life events and family planning support