Threat Hunting Lead

About the role

As a Threat Hunting Lead you will own the hunt plan and drive intelligence‑driven investigations across endpoint, identity, network, email and AWS telemetry for a large US consumer lender. You will lead two Threat Hunting Analysts located in Buenos Aires and Colombia and work closely with the Detection Engineering Lead to turn successful hunts into operational detections.

Key responsibilities

• Develop and prioritize hunt hypotheses based on threat intel, recent incidents and telemetry gaps.
• Execute scheduled and ad‑hoc hunts using CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic.
• Map findings to MITRE ATT&CK techniques, track living‑off‑the‑land, credential abuse and lateral movement.
• Collaborate with incident response during major incidents and hand off detection backlog items.
• Prepare and present clear hunt reports to the client’s security leadership.

Required profile

• 5+ years of hands‑on threat hunting, Tier 3 investigation or incident response experience.
• Proven ability to lead or mentor analysts across locations and present to senior security stakeholders.
• Fluent English (B2+/C1) and strong hypothesis‑driven mindset.

Required skills

• Advanced querying in Elastic (EQL/ES|QL), Splunk or Sentinel.
• Deep knowledge of MITRE ATT&CK, LOTL, credential and session abuse detection.
• Experience with CrowdStrike Falcon, Microsoft Defender, SentinelOne, Okta, Palo Alto, Proofpoint.
• Familiarity with threat intel platforms such as MISP, OpenCTI, Recorded Future, FS‑ISAC.
• Hands‑on AWS telemetry analysis, Python and Jupyter for data exploration.

What we offer

• Competitive base salary.
• Flexible work model – hybrid, remote or in‑office.
• Real growth opportunities with leadership visibility.
• Inclusive culture blending U.S. innovation with Colombian heart.
• Company that invests in your development and celebrates wins together.