Threat Hunter

NCC Group

. Proactively hunt and analyse advanced threats across customers’ environments using NCC Group’s proprietary hunting framework .

Posted 10/14/2026full-timeMadrid • SpainMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat hunting using the MITRE ATT&CK framework and advanced threat analysis methodologies. Proficient in scripting and automation tools to operationalize threat intelligence and collaborate effectively across security and engineering teams.

Highest-signal resume keywords

Threat HuntingMITRE ATT&CK FrameworkPython ScriptingSplunk SIEMJupyter Notebooks

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat Intelligence AnalysisTTP AnalysisHypothesis-Driven FrameworksData VisualizationAutomated Hunting PipelinesCloud Architecture UnderstandingSQL QueryingKQL QueryingPowerShell ScriptingAdversary Emulation

Soft Skills

CollaborationPresentation SkillsAutonomous Work

Tools & Technologies

GitLabSigmaCrowdStrikeSentinelOneMicrosoft AzureAmazon Web ServicesGoogle Cloud PlatformSecurity Operations Centre ToolsDetection Engineering ToolsData Science Techniques

Certifications & Qualifications

GCFAOSCPGDATGCIH

Industry Keywords

Threat Hunting FrameworksIncident ResponseMalware AnalysisBlue TeamRed Team

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformPythonSplunkSQL

About the role

Key responsibilities & impact

Proactively hunt and analyse advanced threats across customers’ environments using NCC Group’s proprietary hunting framework
Conduct intelligence-led, hypothesis-driven analysis of tactics, techniques, procedures, and behaviours
Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form and validate hypotheses through structured hunts
Leverage GitLab, Sigma, Jupyter Notebooks, and other tools to automate hunts, visualise results, and create reusable investigation and detection artifacts
Collaborate with detection engineering to convert threat-hunting findings into high-fidelity detection content
Operationalise detections for emerging threats using internal and open-source threat intelligence
Support mapping threat models to monitoring use cases with teams across the business
Document and maintain a repository of hunting methodologies, tooling, and findings
Provide regular reports and presentations to stakeholders, articulating threats, methods, and risk impact
Collaborate cross-functionally with Security Operations Centre Analysts, Global Detection Engineers, Privacy Team, and Engineering Team

Requirements

What you’ll need

Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team role
Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation
Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies
Ability to work autonomously while collaborating across security, engineering, and business teams
Strong scripting/query language skills, such as Python, KQL, SQL, or PowerShell
Experience using one or more of Splunk, Microsoft, CrowdStrike, and SentinelOne SIEM and EDR stacks
Experience translating threat intelligence into actionable insights
Experience working alongside detection engineers and security analysts to operationalise findings
Understanding of hybrid or cloud-native architectures such as AWS, Azure, or GCP
Comfortable presenting findings to stakeholders and documenting methodologies
Hands-on experience using Jupyter Notebooks for data exploration, automation, and visualization in a security context is desirable
Knowledge of cloud products and log events such as Azure, Amazon Web Services, and Google Cloud Platform is desirable
Familiarity with data science and machine learning techniques in security analysis is desirable
Background in building automated hunting pipelines and/or detection-as-code is desirable
GCFA, OSCP, GDAT, GCIH, or similar certifications are desirable but not required

Benefits

Comp & perks

Flexible working options
25 days of holiday plus bank holidays
Option to buy up to 5 additional days of annual leave
Medicash
Critical Illness Scheme
Pension
Life Assurance
Share Save Scheme
Community and volunteering opportunities
Green Car Scheme
Cycle-to-work scheme
Special time off for marriage/civil partnership, becoming a grandparent, and welcoming home a new pet
Generous maternity and paternity leave
Time off and support for fertility treatments