Threat Hunting & Intelligence Lead in London

As the Threat Hunting & Intelligence Lead, you will be a senior security specialist responsible for designing, establishing, and leading an intelligence‑led threat hunting capability across the managed security service. This role combines hands‑on technical excellence, analyst development, and client‑facing leadership to deliver proactive security outcomes beyond traditional SOC alerting. You will reshape the threat hunting programme from the ground up, defining AI enabled methodologies, telemetry requirements, and measures of success before evolving into ongoing hunting execution, coaching analysts, and acting as a trusted advisor to clients and internal stakeholders. The role blends offensive attacker‑mindset insight with deep defensive detection and response expertise, making it a key differentiator for both service delivery and pre‑sales engagements.

Key Responsibilities

• Threat Hunting Programme Development
  • Design and establish a formal, repeatable threat hunting programme, including:
  • Hunting methodologies and frameworks
  • Hypothesis‑driven hunting models
  • Tooling, data sources, and telemetry requirements
  • Clear success metrics and measurable outcomes
• Define and embed how threat hunting integrates with:

• SIEM detections and detection engineering
• SOC operations and workflows
• Incident response processes
• Intelligence‑led prioritisation and use‑case development

Hands‑On Threat Hunting & Intelligence

• Conduct advanced, hands‑on threat hunts in the Microsoft Eco System primarily across:

• Endpoint (EDR/XDR)
• Identity and authentication telemetry
• Cloud platforms and SaaS environments
• SIEM and log‑based data sources

• New or improved detection cases
• Automation opportunities
• SOC operational enhancements
• Detection coverage and fidelity improvements

Analyst Coaching & Capability Uplift

• Coach and mentor SOC analysts through collaborative hunting, developing:

• Threat‑led and adversary‑focused thinking
• Strong investigative depth and analytical reasoning
• Confidence in hypothesis‑driven analysis

Technical Leadership & Collaboration

• Demonstrate deep technical expertise across:

• SIEM platforms
• EDR/XDR technologies
• Cloud security platforms
• Identity and access telemetry

• Detection Engineering teams
• Platform Automation and Engineering
• SOC leadership and incident response leads

Core Experience & Skills

• Extensive experience in threat hunting, detection engineering, or advanced SOC operations.
• Strong understanding of adversary behaviors, attack chains, and modern threat actor tradecraft.
• Deep hands‑on experience with SIEM, EDR/XDR, cloud, and identity telemetry.
• Proven ability to design and operate hypothesis‑driven hunting programmes.
• Experience translating technical findings into business‑level risk and outcomes.
• Strong collaboration and leadership skills within multi‑disciplinary security teams.
• Confident communicator.
• MSSP Background a Positive.
• Relevant certifications such as (or equivalent to): CEH, Offensive security or red team certifications, Advanced detection or threat hunting credentials.