Senior Detection Engineering, Threat Hunting Analyst

• Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on performance.
• Develop rules across Huntress products and operating systems, including ITDR, SIEM, EDR, Windows, Linux, and MacOS.
• Manage DE&TH requests raised internally or escalated from partners.
• Undertake hypothesis-driven hunts across Huntress telemetry to identify techniques and tradecraft that may evade detections and initial SOC review.
• Consume threat intelligence and translate IOCs, TTPs, and internal findings into detections through Git-based workflows.
• Build and refine hunting dashboards or queries to surface potential intrusions.
• Review ambiguous attacker activity and surface likely intrusions requiring deeper investigation.
• Investigate or escalate likely intrusions so partners receive clear incident reports and accurate advice.
• Contribute findings to community-driven projects and create blogs, social posts, videos, podcasts, and webinars.
• Use AI-assisted workflows to prototype queries, enrich analysis, and develop detection-rule scaffolding while validating AI output.
• Work alongside the 24x7 Security Operations Center, Adversary Tactics & Tactical Response, engineering, and adjacent teams.

• 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response.
• Intermediate knowledge of Windows internals.
• Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace.
• Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations.
• Ability to communicate findings through clear written reports.
• Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL.
• A sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system.
• A sound understanding of the roles different threat actors play and their associated goals, such as: initial access brokers, ransomware affiliates, and state-sponsored entities.
• Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments.
• Bonus points for intermediate knowledge of Linux and MacOS internals, hands-on experience with OSquery, Velociraptor, EDR/MDR/XDR platforms, forensic tooling, and intermediate malware analysis skills.

• Fully remote work
• At least one annual trip to the US for Summer Summit, with additional local events in Australia!
• New starter home office set up reimbursement ($800 AUD)
• 12 weeks paid parental leave for both primary and secondary carers
• Monthly digital allowance for personal phone and internet costs ($185 AUD)
• Monthly home office tech stipend to upgrade or replace equipment ($40 AUD)
• Subsidised private health insurance through our preferred provider
• Stock options for all full-time employees
• Access to the BetterUp platform for coaching, personal, and professional growth