Lead Threat Hunter

Allstate

. Lead hypothesis-driven, intelligence-led threat hunting campaigns across enterprise, cloud, and OT/IoT environments .

Posted 10/24/2026full-timeRemote • United StatesSenior💰 $120,000 - $175,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in threat hunting across enterprise, cloud, and OT/IoT environments, utilizing advanced analytics and AI-assisted tooling. Capable of developing and executing detection methodologies, mentoring junior team members, and effectively communicating findings to stakeholders.

Highest-signal resume keywords

Threat Hunting ExpertiseSIEM Platform ExperienceEDR/XDR Platform ProficiencyScripting and Automation SkillsMITRE ATT&CK Framework Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat HuntingSIEM AnalyticsEDR/XDR ToolsPython ScriptingPowerShell ScriptingCQL/KQL/SPL AnalyticsYARASnortSuricataAnomaly Detection

Soft Skills

Analytical SkillsProblem-SolvingWritten CommunicationVerbal CommunicationLeadership

Tools & Technologies

SplunkSentinelElasticCrowdStrikeDefenderSentinelOneTaniumAI/LLM ToolingSOAR PlaybooksIncident Response Tools

Industry Keywords

MITRE ATT&CKAdversary EmulationInsider ThreatFraud HuntingCloud SecurityMalware AnalysisVulnerability ResearchDeception TechnologyOT/ICS SecurityIoT Familiarity

Tech Stack

Tools & technologies

CloudDNSIoTKubernetesPythonSMTPSplunkTCP/IPGo

About the role

Key responsibilities & impact

Lead hypothesis-driven, intelligence-led threat hunting campaigns across enterprise, cloud, and OT/IoT environments
Design and execute custom analytics across SIEM, EDR/XDR, identity, cloud, and network telemetry
Hunt for identity, cloud, AI/LLM, adversary, and deception-related threats
Convert hunt findings into durable detections, signatures, and SOAR playbooks
Use AI and LLM-assisted tooling for query generation, log summarization, entity pivoting, anomaly clustering, and pattern discovery
Produce post-hunt reports with evidence and measurable exposure-reduction outcomes
Partner with Threat Intelligence to operationalize intelligence into hunt missions and collection requirements
Support purple team exercises and validate detection efficacy using adversary emulation campaigns
Develop and maintain custom tooling and automation for hunting, investigation, and analyst efficiency
Mentor junior hunters and contribute to knowledge bases, hunt libraries, and training
Support Incident Response, Forensics, and Insider Threat/Fraud investigations as a senior technical resource
Liaise across Cyber Operations and communicate findings to technical peers and executive leadership
Identify telemetry gaps and partner with engineering teams to improve collection coverage
Develop behavioral, anomaly-based, and baseline-deviation hunting methodologies

Requirements

What you’ll need

7+ years of experience in security operations, including 4+ years dedicated to threat hunting
Deep experience hunting in large, complex enterprise environments
Experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs
Hands-on experience with modern SIEM platforms including Splunk, Sentinel, and Elastic
Hands-on experience with EDR/XDR platforms including CrowdStrike, Defender, SentinelOne, and Tanium
Experience using AI/LLM-assisted tooling for hunting, triage, and analytic development
Working knowledge of MITRE ATLAS, OWASP Top 10 for LLM Applications, and AI-specific threats
Working knowledge of the Diamond Model, Kill Chain, and Pyramid of Pain
Strong scripting and automation skills in Python, PowerShell, Go, and/or Bash
Understanding of TCP/IP, DNS, TLS, HTTP, SMTP, and common network/application protocols
Experience with CQL/KQL/SPL analytics, Sigma, YARA, Snort, and Suricata
Strong analytical, problem-solving, written, and verbal communication skills
Leadership and mentorship capability
Ability to learn new technologies and techniques independently
Demonstrated ownership of end-to-end hunting programs
Background investigation required
Allstate generally does not sponsor individuals for employment-based visas for this position
Dedicated private workspace and reliable internet with minimum speeds of 50 MB download and 5 MB upload when working from home
Desirable qualifications include cloud hunting, adversary emulation, malware analysis, AI/ML security, vulnerability research, container/Kubernetes security, deception technology, insider threat or fraud hunting, OT/ICS or IoT familiarity, relevant security certifications, and published research or open-source detection contributions

Benefits

Comp & perks

Comprehensive technology setup including laptop, monitors, headset, keyboard, and mouse
Monthly connectivity reimbursement for employees eligible to work from home
Fully remote work arrangement
Opportunity for professional growth and skill development
Interview accommodations available upon request