METRO

Threat Hunting Sr. Analyst

Pune, Maharashtra, India · On-site · Full-time

Posted over 6 months ago: check it’s still open

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerMETRO
LocationPune, Maharashtra, India
Work styleOn-site
Employment typeFull-time
Employer posted1 year ago

Responsibilities

available, and focusing hunts on relevant behavioural tactics, techniques, and procedures (TTPs) identified as potential threats to the organization.
Contribute to detection engineering initiatives by identifying opportunities for, and implementation of new detections as an output of threat hunts completed.
Support other functions within security operations by responding to hunt requests and by applying expertise in advanced actors and TTPs for ongoing incidents, working closely with our incident responders.
Research new attack behaviours and TTPs used by threat actors, leading to new hunting and detection opportunities.
Assist in the development and maturity of the threat hunting process and team through development of cutting-edge hunting techniques and introduction of automation into the threat hunting process.
Develop threat hunting hypothesis in collaboration with the threat intelligence team, helping to track relevant threat actors, campaigns and emerging threats and the TTPs they use.
Help in defining the metrics, measurements and analytical tools to quantify surface area of risk, business impact and implement mechanisms to track progress on efforts to reduce those risks.
Cross-train and mentor wider analyst team in the development of threat hunting.
Represent threat hunting to the wider information security team, and to the wider business, including senior stakeholders, through reporting, presentations and knowledge sharing sessions.
Adapts quickly to changing priorities, seeks new ideas, and re-align with team’s priority/roadmap to maximize business productivity.

Show full description

Technical & Soft Skills:

Deep understanding of cyber threats, attack vectors, and common exploitation techniques.
Proficiency in using threat intelligence platforms, open-source tools, and SOC technologies such as Google Chronicle SIEM, CrowdStrike EDR/EPP, Vectra NDR, Qualys VM, Recorded Future TI, etc.
Proficiency in multiple query languages such as YARA, CrowdStrike QL or SPS with an ability to manipulate and analyse large data sets.
Expertise in formulating threat hunting hypotheses and working with available data sets to determine conclusions.
Solid understanding of current TTPs used by threat actors and an ability to replicate behaviours in a lab environment to generate telemetry.
Direct experience working with the Mitre ATT&CK Framework or similar, with an ability to utilise the framework to identify detection gaps for threat hunting.
Strong competence being able to quickly respond to emerging threats, showcasing an ability to develop and perform hunts, while working under strict deadlines.
Strong understanding of Windows, Linux, and network protocols.
Strong knowledge of industry frameworks and standards, such as STIX/TAXII, MITRE ATT&CK, and threat intelligence sharing platforms.
Excellent written and verbal communication skills, including the ability to present complex technical information to both technical and non-technical audiences.
Strong analytical and critical thinking skills, with the ability to analyze complex data sets and identify actionable insights.

Proven experience in collaborating with cross-functional teams and providing guidance on threat intelligence-related matters.

Qualifications

Bachelor’s degree in computer science, Information Technology, Cybersecurity, or in a related field. A master’s degree or Relevant Cyber Security certifications (e.g. CTIA, CREST PTIA, MITRE’s MAD, CySA+) are a plus.
4-7 years of total experience in SOC in a large multi-national organization or in a known MSSP. In addition to SOC Engineering experience, candidate should possess at least 2+ year of experience on Threat Hunting capabilities.

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.