Lead Threat Hunter
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Lead Threat Hunter leading intelligence-driven hunts across enterprise, cloud, OT/IoT, and AI environments. Turning adversary findings into durable detections for Allstate’s insurance and protection business.
Responsibilities:
- Lead hypothesis-driven, intelligence-led threat hunting campaigns across enterprise, cloud, and OT/IoT environments
- Design and execute custom analytics across SIEM, EDR/XDR, identity, cloud, and network telemetry
- Hunt for identity, cloud, AI/LLM, adversary, and deception-related threats
- Convert hunt findings into durable detections, signatures, and SOAR playbooks
- Use AI and LLM-assisted tooling for query generation, log summarization, entity pivoting, anomaly clustering, and pattern discovery
- Produce post-hunt reports with evidence and measurable exposure-reduction outcomes
- Partner with Threat Intelligence to operationalize intelligence into hunt missions and collection requirements
- Support purple team exercises and validate detection efficacy using adversary emulation campaigns
- Develop and maintain custom tooling and automation for hunting, investigation, and analyst efficiency
- Mentor junior hunters and contribute to knowledge bases, hunt libraries, and training
- Support Incident Response, Forensics, and Insider Threat/Fraud investigations as a senior technical resource
- Liaise across Cyber Operations and communicate findings to technical peers and executive leadership
- Identify telemetry gaps and partner with engineering teams to improve collection coverage
- Develop behavioral, anomaly-based, and baseline-deviation hunting methodologies
Requirements:
- 7+ years of experience in security operations, including 4+ years dedicated to threat hunting
- Deep experience hunting in large, complex enterprise environments
- Experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs
- Hands-on experience with modern SIEM platforms including Splunk, Sentinel, and Elastic
- Hands-on experience with EDR/XDR platforms including CrowdStrike, Defender, SentinelOne, and Tanium
- Experience using AI/LLM-assisted tooling for hunting, triage, and analytic development
- Working knowledge of MITRE ATLAS, OWASP Top 10 for LLM Applications, and AI-specific threats
- Working knowledge of the Diamond Model, Kill Chain, and Pyramid of Pain
- Strong scripting and automation skills in Python, PowerShell, Go, and/or Bash
- Understanding of TCP/IP, DNS, TLS, HTTP, SMTP, and common network/application protocols
- Experience with CQL/KQL/SPL analytics, Sigma, YARA, Snort, and Suricata
- Strong analytical, problem-solving, written, and verbal communication skills
- Leadership and mentorship capability
- Ability to learn new technologies and techniques independently
- Demonstrated ownership of end-to-end hunting programs
- Background investigation required
- Allstate generally does not sponsor individuals for employment-based visas for this position
- Dedicated private workspace and reliable internet with minimum speeds of 50 MB download and 5 MB upload when working from home
- Desirable qualifications include cloud hunting, adversary emulation, malware analysis, AI/ML security, vulnerability research, container/Kubernetes security, deception technology, insider threat or fraud hunting, OT/ICS or IoT familiarity, relevant security certifications, and published research or open-source detection contributions
Benefits:
- Comprehensive technology setup including laptop, monitors, headset, keyboard, and mouse
- Monthly connectivity reimbursement for employees eligible to work from home
- Fully remote work arrangement
- Opportunity for professional growth and skill development
- Interview accommodations available upon request
Similar Jobs
Cyber Threat Analyst – Detection, Automation Engineering
Cyber threat analyst automating security detection and integrations for phia, a federal cybersecurity services company. Supporting SOC, threat intelligence, and incident response operations.
Senior Threat Hunter
Senior Threat Hunter mentoring global security teams and building AI-driven cyber defense exercises. SimSpace provides an AI proving ground for training, testing, and validating cybersecurity defenses.
Senior Artificial Intelligence Analyst
Analista sênior desenvolvendo soluções com LLMs, IA generativa e APIs para o setor de saúde. Transformando protótipos em aplicações robustas com engenharia de software e MLOps no Grupo Fácil.
Field Intelligence Analyst
Field Intelligence Analyst guiding Sayari’s AI platform for economic security and commercial risk investigations. Owning customer engagements, validating AI analysis, and training analysts.
Threat Intelligence Specialist – APAC
Threat intelligence specialist protecting Kodex’s secure data exchange platform for law-enforcement agencies across APAC. Investigating identity fraud, threat actors, and urgent security cases during Singapore hours.
Senior Media Intelligence Analyst
Senior Media Intelligence Analyst delivering curated media reports, newsletters, and executive digests for Muck Rack’s AI-powered PR SaaS platform. Reviewing AI outputs and improving client service quality.
Senior Engineering Intelligence Analyst
Senior Engineering Intelligence Analyst building Looker dashboards and data pipelines for Five9’s cloud contact center software. Enabling engineering leaders to make faster, data-driven portfolio decisions.
Senior Threat Intelligence Specialist
Senior Threat Intelligence Specialist analyzing open-source cybersecurity incidents and vendor risks at Fortress Information Security. Producing assessments, improving intelligence processes, and supporting critical infrastructure protection.
Senior Revenue Intelligence Analyst
Revenue Intelligence Senior Analyst building sales models, dashboards, and forecasts for Teaching Strategies, an early childhood education technology company. Supporting revenue operations, Finance, sales teams, and leadership with actionable insights.
Senior Payor Intelligence Analyst
Payor intelligence analyst mapping U.S. insurance entities, policies, and authorization logic. Building data systems for Tennr’s healthcare paperwork automation platform.
Intelligence Analyst
Part-time Intelligence Analyst providing open-source cyber intelligence for DarkTower, which helps clients identify and reduce cyber risks. Researching threats, assessing risk, and producing actionable reports.
Senior Cyber Threat Analyst
Senior Cyber Threat Analyst leading ransomware communications, negotiations, and adversary intelligence. Supporting Vector3 and TMHCC incident response through analysis, documentation, and team mentorship.
Senior Cybersecurity Threat Hunter
Senior Cybersecurity Threat Hunter leading proactive threat detection at Uni Systems. Managing hunting campaigns, telemetry analysis, detection engineering, incident response support, and threat-informed security improvements.
Exposure Intelligence Analyst – Databases, Data Stores, RDBMS, NoSQL, Object Storage, Permissions
Exposure Intelligence Analyst securing Allstate’s databases, cloud data stores, and permissions. Identifying exploitable access paths and guiding remediation to reduce enterprise data exposure.
Intelligence Analyst
Intelligence Analyst supporting cyber threat customers and ensuring value realization from purchased Intelligence products at CrowdStrike.
Senior Cyber Threat Analyst
Senior Cyber Threat Analyst at Harbor IT investigating complex security incidents and communicating findings with clients. Collaborating with SOC analysts and providing escalation support.
Cyber Intelligence Analyst
Cyber Intelligence Analyst at UPS participating in threat identification and mitigation efforts. Provide support on a rotating basis, ensuring client understanding of security protocols and events documentation.
Cyber Threat Hunter
Cyber Threat Hunter protecting systems from cyber threats at a global insurance and asset management company. Utilizing automation and machine learning for scalable detection of anomalies and threats.
Exposure Intelligence Analyst – Endpoint & Identity, EDR, AD-Entra, PAM, MFA
Exposure Intelligence Analyst at Allstate identifying and prioritizing risks in endpoint and identity systems. Collaborating with teams to enhance security posture and mitigate vulnerabilities.
Exposure Intelligence Analyst – Cloud Platforms, AWS, Azure, GCP, Cloud Posture
Lead Consultant for cloud platforms securing cloud environments at Allstate. Identifying exploitable risks across AWS, Azure, and GCP while ensuring risk prioritization and remediation strategies.