Cyber Security Threat Hunter

Job Details: Cyber Security Threat Hunter

Full details of the job.

• Vacancy Name
• Vacancy Name Cyber Security Threat Hunter
• Vacancy No
• Vacancy No VN903
• Location Country
• Work Location

As a Cyber Security Threat Hunter, you will protect Utmost’s networks and systems from cyber threats and unauthorised access.

You will monitor and investigate security events, assess their impact, and either resolve issues or elevate them based on severity.

This role blends proactive threat hunting with authorised adversary simulation to strengthen detection and response across endpoints, identities, email and cloud environments.

You will emulate real-world techniques, investigate suspicious activity using Microsoft security platforms, and turn findings into actionable recommendations and improved detections.

• Core responsibilities
• Threat hunting and investigation: Proactively identify and investigate suspicious behaviours across endpoint, identity, email and cloud telemetry using Microsoft Defender XDR and Advanced Hunting (KQL).
• Detection content ownership: Convert hunt outcomes into operational detections (e. g., Sentinel analytics rules, Defender custom detections, watchlists/workbooks) and continuously tune to improve signal quality and reduce noise.
• Adversary simulation: Emulate modern threat actors (including APT-style behaviours) to test security resilience and validate detections.
• Covert authorised testing: Execute time-bound, approved exercises to identify detection gaps and response friction (including attempts to bypass controls where authorised).
• Governance and rules of engagement: Follow documented approvals and scope constraints; operate safely, record actions taken, and preserve evidence for audit and incident follow-up.
• Vulnerability assessment and controlled exploitation: Conduct scoped assessments and vulnerability scans and, where authorised, safely demonstrate impact to support prioritised remediation.
• Lateral movement and post-compromise testing: Assess internal segmentation and privilege boundaries by attempting controlled movement after initial access.
• Social engineering: Conduct approved phishing and other social engineering techniques to assess human-layer controls and awareness.
• XDR and SIEM operations: Use Microsoft Sentinel for log analytics/correlation and Defender for Cloud to support securing cloud assets (Azure and multi-cloud where applicable).
• Telemetry correlation: Correlate Microsoft signals with key third-party telemetry (e. g., firewall, proxy, DNS, VPN, Saa S) and validate data quality to close coverage gaps.
• Threat intelligence leverage: Use Microsoft Defender Threat Intelligence to understand adversary infrastructure and behaviours and to inform hunts, simulations, and blocking actions.
• Hunt lifecycle and deliverables: Own the hunt cycle (hypothesis validate data execute document improve) and publish repeatable hunt packages (queries, rationale, expected results, tuning notes).
• Reporting and remediation: Document objectives, evidence and prioritised recommendations; partner with teams to remediate and tune detections.
• Incident response support: Support containment and recovery activities, assist with root-cause analysis, and capture lessons learned to improve future response.

The role holder is expected to deputise for the Information Security Officers in the security team when required, and to attend regular departmental meetings and other meetings relevant to the role.

Key Responsibilities

• Cyber Risk
• Oversight, management, and reporting on all risks pertaining to information security, including all forms of cyber risk and all risks relating to the protection of personal data throughout the business in all locations.
• Developing and monitoring Key Risk Indicators (KRI) and Key Performance Indicators (KPI), relating to the information security controls of the business.
• Assist in the assessment of risk to the security of information, assets and personnel.
• Assist in management of cyber risk including risk reviews and mitigation planning.
• Customer Management
• Commits to exceeding expectations and needs to internal/external customers, possesses “customer first” mind set.
• Ensures that work is accurate and well presented, that customer care is given priority above all else and that in both areas effort is made to exceed the minimum standard required.
• Shows concern for detail no matter how small.
• Takes a pride in doing a job well.

Skills

• Windows and identity fundamentals: Strong understanding of Windows security concepts and Microsoft identity (Active Directory and Entra ID), including authentication and token flows (Kerberos/NTLM/OAuth), device join states, MFA/Conditional Access concepts, and common identity attack paths.
• Endpoint telemetry literacy: Ability to interpret process trees and command lines, Power Shell activity, scheduled tasks/services, registry and file changes, WMI usage, persistence techniques, and LOLBins and to connect these artifacts to Defender alerts and timelines.
• Microsoft 365 and cloud security foundations: Familiarity with email security and message flow (Exchange Online), and investigation pivots across Share Point/One Drive/Teams activity and Azure logs where relevant to XDR incidents.
• Detection engineering mindset: Experience translating hunts and red team findings into practical detections and improvements (signal selection, tuning, suppression/thresholding, entity mapping, documentation, and operational handoff).
• KQL depth and query performance: Comfortable using joins/unions, parsing, time-windowing, summarisation, baselining, and performance-aware query patterns for large datasets.
• Log onboarding and data quality (Sentinel): Understanding of data connectors, schema/field consistency, normalisation, time sync considerations, and how missing/low-quality telemetry impacts detections.
• Incident response operations: Ability to scope incidents, preserve evidence, choose containment actions, and collaborate with stakeholders on remediation and lessons learned.
• Automation: Practical skills in scripting and basic automation concepts (e. g., enrichment and response workflows) to make hunts and investigations repeatable.
• Ability to work effectively under pressure during a security incident.
• Process mapping and data analysis skills
• Analytical skills – Interprets quantitative and qualitative information to achieve objective and produces effective solutions to problems.
• Ability to work in tight deadlines and delivering solutions within defined time periods.
• Demonstrated experience in incident response, cybersecurity, or digital forensics, and the ability to write clear, concise technical reports.
• Experience working in a complex operational environment
• Effective verbal and written communication skills and strong interpersonal skills, good at reporting
• Behaviours
• A proactive mindset to anticipate and address potential threats.
• Being cooperative, flexible, adaptable, and persistent.
• Diligence - Being careful about detail and through in completing work
• Integrity - Being honest and ethical
• Independence – developing one’s own ways of doing things, guiding oneself with little or no supervision, depending on oneself to get things done.
• Must be willing to travel occasionally between offices in all Utmost territories where required (infrequent)
• Key Tasks
• Key Requirements

As a Cyber Security Threat Hunter, you’ll need

• Hands-on security operations experience: Working knowledge of SOC workflows including triage, investigation, containment, and improvement of detections.
• Microsoft security tooling: Experience investigating and hunting in Microsoft Defender XDR and leveraging Microsoft Sentinel for broader log analytics.
• KQL proficiency: Write and refine Advanced Hunting queries (KQL) to analyse endpoint, email and identity telemetry (e. g., Device Events, Device File Events, Email Events).
• Cloud security fundamentals: Familiarity with securing cloud workloads and assets using Microsoft Defender for Cloud (Azure and multi-cloud environments).
• Red team / offensive fundamentals: Practical experience with penetration testing concepts, exploitation workflows, and post-exploitation tradecraft in controlled environments.
• Networking and OS knowledge: Strong understanding of common protocols (e. g., DNS, HTTP) and operating system internals and telemetry.
• Forensics fundamentals: Comfortable with host triage, timeline building, and evidence handling concepts to support investigations and root-cause analysis.
• Tools: Comfort with common security tooling such as Kali Linux, Metasploit, and Wireshark.
• Scripting/programming: Ability to automate tasks and build custom tooling using Python, Power Shell, or Golang.
• SOAR and repeatability: Create repeatable investigation workflows (playbooks/runbooks) and use automation where appropriate (e. g., Sentinel automation rules/Logic Apps).
• Adversary tradecraft knowledge: Understanding of MITRE ATT&CK tactics/techniques and how to map observations and simulations to that framework.
• Threat modelling and prioritisation: Ability to prioritise hunts using business risk, crown-jewel assets, attack paths, recent intelligence, and MITRE coverage gaps.
• Knowledge

• Experience or qualifications

• At least 3 years’ hands-on experience in

• Incident response processes/methodologies and SIEM operations.
• Security tooling, reporting, and delivering work in a structured/project-based way.
• IT/networking/security fundamentals including operating systems, networking and digital forensics.
• Microsoft Azure and Microsoft 365 cloud technologies.
• Threat intelligence-driven hunting: Demonstrated use of threat intelligence to plan hunts, enrich detections, and block malicious infrastructure.
• Bachelor's degree in cybersecurity, computer science, or IT is desirable.
• Management experience that encompasses information systems or information security experience.
• Relevant certification is preferred: Microsoft

Certified: Security Operations Analyst Associate (SC-200) or equivalent demonstrated experience, Comp TIA Cybersecurity Analyst (Cy SA+), GIAC Certified Incident Handler (GCIH), ISACA Certified Cybersecurity Operations Analyst(CCOA).

• Copilot for Security: Experience using AI-assisted investigation workflows such as the Security Analyst Agent in Microsoft Defender to accelerate triage and deep investigations.
• #J-18808-Ljbffr