SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: AUD 150,000 - 170,000 / annual
Huntress, founded in 2015 by former NSA cyber operators, is a remote-first cybersecurity company making enterprise-grade security accessible to businesses of all sizes. The company operates a 24/7 human-led Security Operations Center (SOC) and now secures 5M+ endpoints and 15M+ identities worldwide.
As a Senior Detection Engineering & Threat Hunting Analyst, you will be part of the Detection Engineering & Threat Hunting (DE&TH) team, working alongside the SOC and Adversary Tactics & Tactical Response function to detect and impede threat actors before they impact customer environments.
On the Detection Engineering side, you will design, build, and maintain a resilient, scalable, high-fidelity detection portfolio across multiple domains (identities and endpoints). You will create new detection rules, test them before deployment, monitor efficacy, and tune or retire rules based on performance. You will develop rules across Huntress products and operating systems including Identity Threat Detection and Response (ITDR), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Windows, Linux, and macOS. You will consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows.
On the Threat Hunting side, you will research new attacker tradecraft, test hypotheses, and review hunting data at scale across millions of endpoints to proactively hunt for and disrupt stealthy threat actor techniques that evade initial defenses. You will undertake hypothesis-driven hunts prioritizing techniques that may evade high-fidelity detections, build and refine hunting dashboards or queries, and review ambiguous signs of attacker activity to surface likely intrusions.
Additional responsibilities include managing DE&TH requests from internal teams or escalated from partners, investigating or escalating likely intrusions to ensure partners receive clear incident reports, contributing findings to community-driven projects and Huntress content (blogs, social posts, videos, podcasts, webinars), and using AI-assisted workflows to prototype queries, enrich analysis, and develop detection rule scaffolding while applying sound judgment to validate AI output.
REQUIREMENTS:
- 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response
- Intermediate knowledge of Windows internals
- Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace
- Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations
- Ability to communicate findings through clear written reports
- Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL
- Sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system
- Sound understanding of the roles different threat actors play and their associated goals, such as initial access brokers, ransomware affiliates, and state-sponsored entities
- Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments
BONUS:
- Intermediate knowledge of Linux and macOS internals
- Hands-on experience using tools to remotely discover evidence of compromise such as OSquery, Velociraptor, and EDR/MDR/XDR platforms
- Previous use of forensic tooling such as Eric Zimmerman's EZ Tools, RegRipper, Hayabusa, or Chainsaw to analyze endpoint artifacts
- Intermediate malware analysis skills
