The Role
Conduct hypothesis-driven threat hunting to identify sophisticated adversaries across customer environments. Analyze adversary tactics, techniques, and procedures using threat intelligence, MITRE ATT&CK, and risk models. Automate hunts with scripting, notebooks, and security tools; collaborate with detection engineers to develop high-fidelity detections; document methodologies; and present findings and risk impacts to stakeholders.
Summary Generated by Built In
We are seeking a highly capable and hands-on Threat Hunter to join a passionate and motivated, industry-leading team focused on identifying sophisticated adversaries through hypothesis-driven analysis and automation. You will be responsible for proactively hunting and analysing advanced threats across the customers environment using our proprietary hunting framework, ensuring our threat models and threat hunts are tightly aligned to the customer.
As a Threat Hunter, you will actively search for cyber threats that evade traditional security solutions. Your role will involve conducting in-depth intelligence-led, hypothesis-driven analysis of TTPs and behaviours, and working cross-functionally with the Security Operations Centre Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks.
Key Responsibilities
- Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
- Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections.
- Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content.
- Utilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats.
- Support the mapping of threat models to monitoring use cases in partnership with teams across the business.
- Document and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling.
- Provide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact.
Skills, Knowledge & Expertise
- The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration.
- They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions.
- Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks.
- Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings.
- They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments—including hybrid or cloud-native architectures like AWS, Azure, or GCP.
- They will be comfortable presenting findings to stakeholders and documenting methodologies.
- They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.
Minimum Requirements
- Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysisor Blue Team role.
- Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation.
- Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies.
- Ability to work autonomously while collaborating across security, engineering, and business teams.
- Strong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell).
Desirable Requirements
- Hands-on experience using Jupyter Notebooks for data exploration, automation, and visualization in a security context.
- Knowledge of cloud products and log events such as Azure, Amazon Web Services, Google Cloud Platform.
- Familiarity with data science and machine learning techniques in security analysis.
- Background in building automated hunting pipelines and/or detection-as-code.
Desirable Certifications
- GCFA
- OSCP
- GDAT
- GCIH
- Or similar certifications, not required but certainly desirable.
Job Benefits
- Flexible Working: Balance your work and personal life with our flexible working options.
- Generous Holiday Allowance: Enjoy 25 days of holiday, plus bank holidays, with the option to buy up to 5 additional days of annual leave.
- Medicash & Critical Illness Scheme
- Financial & Investment Benefits: Enjoy peace of mind with our Pension, Life Assurance, and Share Save Scheme.
- Community & Volunteering Programmes: Make a difference in your community with our volunteering opportunities.
- Green Car Scheme: Drive green and save money with our eco-friendly car scheme.
- Cycle Scheme: Stay fit and healthy with our cycle-to-work scheme.
- Special Time Off: Take time off for those big moments in life, like getting married/entering into a civil partnership, becoming a grandparent, and welcoming home a new pet.
- Family Planning: Benefit from our generous maternity and paternity leave, as well as time off and support for those undergoing fertility treatments.
About
We assess, develop and manage cyber threats across our increasingly connected society. We advise global technology, manufacturers, financial institutions, critical national infrastructure providers, retailers and governments on the best way to keep businesses, software and personal data safe.With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate & respond to the risks they face.We are passionate about making the Internet safer and revolutionising the way in which organisations think about cyber security.Headquartered in Manchester, UK, with over 35 offices across the world, NCC Group employs more than 2,000 people and is a trusted advisor to 15,000 clients worldwide.
Skills Required
- Experience in a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis, or Blue Team role
- Strong understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation
- Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies
- Ability to work autonomously and collaborate across security, engineering, and business teams
- Strong scripting or query language skills, such as Python, KQL, SQL, or PowerShell
- Experience using Splunk, Microsoft, CrowdStrike, or SentinelOne SIEM and EDR stacks
- Experience translating threat intelligence into actionable insights and operationalizing findings
- Hands-on experience using Jupyter Notebooks for security data exploration, automation, and visualization
- Knowledge of AWS, Azure, or Google Cloud Platform products and log events
- Familiarity with data science and machine learning techniques for security analysis
- Experience building automated hunting pipelines or detection-as-code
- GCFA, OSCP, GDAT, GCIH, or similar certification
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
NCC Group is a global cyber security and resilience company that helps organizations manage risk, strengthen resilience, and build trust. They provide services in cyber security consulting, managed services, technical assurance, and software escrow.
.png){kind=logo}
