Principal Threat Hunting and Emulation Engineer, Elastic

• At least 8 years of experience in information security with a focus on threat hunting, detection engineering, incident response, or red/purple team operations with the Elastic Stack
• Demonstrated experience in conducting structured and hypothesis-driven threat hunts in complex enterprise or cloud-native environments. The focus is on forward-thinking threat hunting, not just reactive investigation
• Familiarity with threat hunting frameworks such as PEAK, TaHiTI, or Sqrrl, and the ability to apply them operationally and at scale
• Experience designing and executing adversary emulation exercises or purple team engagements, including scoping, execution, and post-exercise reporting
• Working knowledge of adversary TTPs through frameworks such as MITRE ATT&CK, and the ability to map real-world threat intelligence to hunt hypotheses
• Experience using AI-assisted tooling or large language models to support threat hunting workflows, such as hypothesis generation, log summarization, or anomaly triage
• Scripting or coding ability to automate repetitive hunt tasks or build custom tooling
• A curious, research-driven mindset. You read threat reports, study malware, and seek to understand attacker behavior at a deep level
• Strong written communication skills with an ability to document technical findings clearly for both technical and executive audiences
• Is eligible to work in Department of Defense (DoD) Impact Level 4 or above cloud service environments

Desirable

• As a Principal Threat Hunting and Emulation Engineer at Elastic, you are at the forefront of proactively defending Elastic’s products, services, and people
• This is not a reactive role—you will lead structured, hypothesis-driven hunts across Elastic’s global environment to uncover threats that evade automated detection
• You will design and execute adversary emulation exercises to stress-test our detection pipelines, validate coverage, and drive continuous improvement
• You’ll partner deeply with Detection Engineering, Incident Response, and Threat Intelligence to ensure that what we hunt for translates directly into durable detections and hardened defenses
• You are a practitioner first
• You think like an adversary, operate like an analyst, and build like an engineer
• If combining structured threat hunting frameworks, AI-assisted analysis, and real-world adversary emulation in a best-in-class security environment excites you, we’d love to meet you!
• Lead structured, hypothesis-driven threat hunting operations across Elastic’s cloud, SaaS, endpoint, and CI/CD environments using frameworks such as PEAK, TaHiTI, or equivalent
• Develop and maintain a threat hunting program at scale. Defining hunt hypotheses based on threat intelligence, ATT&CK mappings, and environmental risk profiles
• Design and execute adversary emulation exercises and purple team engagements to validate detection pipelines, identify coverage gaps, and simulate real-world threat actor TTPs
• Build and maintain a threat emulation library of reusable attack simulations, leveraging tools such as Atomic Red Team, Caldera, Scythe, or custom-developed tooling
• Leverage AI and machine learning capabilities to accelerate hypothesis generation, anomaly detection, and the analysis of large, complex datasets during hunts
• Translate hunt findings into production-ready detections, collaborating closely with Detection Engineering to ensure durable coverage
• Document and codify hunt methodologies, playbooks, and emulation plans so that findings are repeatable, reviewable, and transferable
• Partner with Threat Intelligence to inform hunt hypotheses based on emerging adversary campaigns, newly disclosed vulnerabilities, and sector-specific threat profiles
• Identify visibility gaps exposed through hunting and emulation, and collaborate with Security Engineering to onboard the log sources needed to close them
• Support incident response activities by applying hunting skills to accelerate investigation, scope incidents, and identify attacker dwell time or lateral movement
• Contribute to the broader security community through blog posts, conference talks, open-source tooling, and other public knowledge sharing