Senior Detection Engineering & Threat Hunting Analyst

The role

You will perform detection engineering and threat hunting to impede threat actors. You will design, build, and maintain a detection portfolio and conduct hypothesis-driven hunts across telemetry.

What you will do

• Create, test, monitor, and tune new detection rules.
• Develop rules across Huntress products and operating systems including ITDR, SIEM, EDR, Windows, Linux, and MacOS.
• Manage internal and partner escalated DE&TH requests.
• Undertake hypothesis-driven hunts across Huntress telemetry.
• Translate threat intelligence, IOCs, and TTPs into detections using Git-based workflows.
• Build and refine hunting dashboards or queries.
• Review ambiguous signs of attacker activity and surface likely intrusions.
• Investigate or escalate likely intrusions to ensure accurate incident reports.
• Contribute findings to community-driven projects and create Huntress content.
• Use AI-assisted workflows to prototype queries and develop detection rule scaffolding.

Required qualifications

• 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.
• Intermediate knowledge of Windows internals.
• Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.
• Experience developing, testing, tuning, and documenting detections from threat intelligence, IOCs, hypotheses, or real-world investigations.
• Ability to communicate findings through clear written reports.
• Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA.
• Strong familiarity with query languages such as KQL, EQL, ES|QL, or Splunk SPL.
• A sound understanding of adversary tradecraft including persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection.
• A sound understanding of the roles different threat actors play.
• Ability to orchestrate reusable AI workflows and verify AI-generated outputs.

Nice to have

• Intermediate knowledge of Linux and MacOS internals.
• Hands-on experience using tools to remotely discover evidence of compromise such as OSquery, Velociraptor, and EDR/MDR/XDR platforms.
• Previous use of forensic tooling such as Eric Zimmerman's EZ Tools, RegRipper, Hayabusa, or Chainsaw.
• Intermediate malware analysis skills.

Benefits

• Fully remote work
• At least one annual trip to the US for Summer Summit, with additional local events in Australia
• New starter home office set up reimbursement ($800 AUD)
• 12 weeks paid parental leave for both primary and secondary carers
• Monthly digital allowance for personal phone and internet costs ($185 AUD)
• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)
• Subsidised private health insurance through our preferred provider
• Stock options for all full-time employees
• Access to the BetterUp platform for coaching, personal, and professional growth

About the company

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes.