Lead Threat Hunter, CrowdStrike

• Bachelor's degree (or equivalent experience) in a computer-related field
• 8+ years of progressive experience in Information Security, Threat Hunting, or related roles
• Proven understanding of the MITRE ATT&CK framework, Diamond Model, and Cyber Kill
• Chain
• Experience analyzing raw data from security controls (web proxy, firewalls, IPS, IDS, antivirus)
• Proficiency with SIEM, SOAR, TIP integrations, and link analysis tools
• Strong IT background (networking fundamentals, systems) and expertise with OSX, Linux, and Windows
• Significant experience with system/application log analysis and security data correlation
• Effective communication skills in English (verbal and written)
• Excellent investigative, analytical, and problem-solving abilities
• Ability to maintain strict confidentiality and operate independently in high-pressure situations

Desirable

• As a Lead Threat Hunter you will be a key member of our Security Operations team, driving the detection, investigation, and response to advanced cyber threats
• In this role, you will design and refine detection patterns across various technologies, participate in active threat hunting, and guide the organization's security posture with your insights and expertise
• Your ability to operate across a wide array of data sources, maintain rigorous confidentiality, and provide hands-on incident response will be critical to safeguarding CrowdStrike's assets and reputation
• Leadership & Program Management:
• Lead and define organizational threat hunting strategy
• Guide and mentor junior threat hunters
• Provide technical leadership and expertise to the Incident Response team
• Design and implement structured hunting frameworks
• Prioritize hunting operations based on threat intelligence and risk
• Measure and report on program effectiveness
• Champion agile project management fundamentals for hunting initiatives
• Threat Detection & Analysis:
• Develop detection patterns across different technologies and log sources
• Triage detections to identify and remediate threats, including containment and live response
• Execute structured threat hunting missions using hypothesis-driven approaches
• Create and implement custom hunting queries and detection logic
• Leverage structured analytic techniques and MITRE ATT&CK framework to track adversarial behavior
• Incident Response & Escalation:
• Participate in incident response activities, providing technical expertise
• Offer on-demand after-hours support for critical security incidents
• Collaborate with cross-functional teams on threat mitigation
• Transform hunt findings into actionable incident response procedures
• Develop threat hunting use cases based on incident response findings
• Security Data Management & Reporting:
• Identify coverage gaps and optimize security data and tooling
• Prepare and present hunting metrics to technical and executive stakeholders
• Utilize OSINT and closed intelligence sources for threat analysis
• Maintain comprehensive hunt documentation and knowledge base
• Develop and maintain hunting dashboards for program visibility
• Tooling & Integration:
• Engineer and tune security detections for SOAR, SIEM, and TIP
• Develop and maintain custom hunting tools and scripts
• Integrate hunting capabilities into existing security stack
• Automate routine hunting tasks and data collection
• Cross-functional Collaboration:
• Partner with key stakeholders (Networking, Infrastructure, DevOps)
• Coordinate threat management approaches across security teams
• Present findings and recommendations to various audience levels
• Drive continuous improvement through knowledge sharing and innovation