Threat Hunter

NCC Group

. Proactively hunt and analyse advanced threats across customer environments using NCC Group’s proprietary hunting framework .

Posted 9/22/2026full-timeManchester • United KingdomMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in advanced threat hunting using the MITRE ATT&CK framework and hypothesis-driven methodologies, with strong capabilities in translating threat intelligence into actionable insights. Proficient in collaborating across security and engineering teams while effectively communicating findings to stakeholders.

Highest-signal resume keywords

Threat HuntingMITRE ATT&CK FrameworkPython ScriptingSplunk SIEMCloud-Native Architectures

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat Intelligence AnalysisTTP AnalysisAdversary EmulationHypothesis-Driven MethodologiesScripting SkillsSQLKQLPowerShellIncident ResponseMalware Analysis

Soft Skills

CollaborationAutonomyPresentation SkillsDocumentation

Tools & Technologies

GitLabSigmaJupyter NotebooksCrowdStrikeSentinelOneMicrosoft SIEMAWSAzureGCP

Industry Keywords

Red TeamBlue TeamSecurity Operations CentreDetection EngineeringThreat Models

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformPythonSplunkSQL

About the role

Key responsibilities & impact

Proactively hunt and analyse advanced threats across customer environments using NCC Group’s proprietary hunting framework
Conduct intelligence-led, hypothesis-driven analysis of TTPs and behaviours
Use the HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form and validate hunting hypotheses
Leverage GitLab, Sigma, Jupyter Notebooks, and other tools to automate hunts, visualise results, and create reusable investigation and detection artifacts
Collaborate with detection engineering to convert threat hunt findings into high-fidelity detection content
Operationalise detections for emerging threats using internal and open-source threat intelligence
Support mapping threat models to monitoring use cases with teams across the business
Document and maintain repositories of hunting methodologies, tooling, and findings
Provide regular reports and presentations to stakeholders explaining threats, methods, and risk impact
Work cross-functionally with Security Operations Centre Analysts, Global Detection Engineers, Privacy Team, and Engineering Team

Requirements

What you’ll need

Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis or Blue Team role
Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation
Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies
Hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles
Experience using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks
Experience translating threat intelligence into actionable insights
Experience working alongside detection engineers and security analysts to operationalise findings
Understanding of hybrid or cloud-native architectures such as AWS, Azure, or GCP
Ability to work autonomously while collaborating across security, engineering, and business teams
Strong scripting/query language skills, such as Python, KQL, SQL, or PowerShell
Comfortable presenting findings to stakeholders and documenting methodologies
Ability to detect and investigate advanced threats beyond signature-based solutions

Benefits

Comp & perks

Flexible working options
25 days of holiday plus bank holidays
Option to buy up to 5 additional days of annual leave
Medicash
Critical Illness Scheme
Pension
Life Assurance
Share Save Scheme
Community and volunteering opportunities
Green Car Scheme
Cycle-to-work scheme
Special time off for marriage/civil partnership, becoming a grandparent, and welcoming home a new pet
Generous maternity and paternity leave
Time off and support for fertility treatments