Threat Hunting Analyst

About the role

Join AspenView’s security operations team supporting a large US consumer lender. You will design and run hypothesis‑driven hunts across endpoint, identity, network, email and AWS telemetry, turning raw intelligence into actionable detections.

Key responsibilities

• Build hunts from threat intelligence, map attacker techniques to MITRE ATT&CK and select appropriate data sources.
• Execute scheduled and ad‑hoc hunts across CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic.
• Investigate findings, separate noise from real threats, and escalate live attacker activity to Tier 3 and Incident Response.
• Partner with Detection Engineering to hand‑off detections, document logging gaps and ensure hunts become production rules.
• Write clear, reproducible hunt reports and present findings to the client’s security team in English.

Required profile

• 3+ years of experience in threat hunting, Tier 3 investigation or incident response.
• Strong ability to work independently, stay rigorous and curious.
• Confidence presenting findings directly to a US client’s security team.
• Interest in growing into a Threat Hunting Lead, IR Lead or Detection Engineering Lead role.

Required skills

• Elastic Security (EQL, ES|QL) and equivalent SIEMs (Splunk, Microsoft Sentinel).
• Threat intel platforms: MISP, OpenCTI, Recorded Future, FS‑ISAC.
• Endpoint and cloud security tools: CrowdStrike Falcon, Microsoft Defender, SentinelOne, Palo Alto, Proofpoint.
• Cloud and identity telemetry: AWS control‑plane, Okta.
• Programming/analysis: Python, Jupyter.

What we offer

• Competitive base salary.
• Flexible work model: hybrid, remote or in‑office.
• Real growth opportunities and visibility with leadership.
• Inclusive, respectful culture blending US innovation with Colombian heart.
• A company that listens, invests in you and celebrates wins together.