Digital Threat Hunting Specialist

About the role

Help AG is seeking an experienced Digital Threat Hunting Specialist to proactively identify, investigate, and mitigate advanced cyber threats across enterprise, cloud and hybrid environments. The role focuses on hypothesis‑driven hunting, advanced analysis, detection engineering and continuous improvement of the organization’s cyber defence capabilities.

Key responsibilities

• Conduct hypothesis‑driven threat hunting across networks, endpoints, cloud and hybrid environments to uncover advanced persistent threats and hidden malicious activity.
• Investigate suspicious events using the MITRE ATT&CK framework and analyse attacker tactics, techniques and procedures.
• Analyse security logs, endpoint telemetry, network traffic, authentication events and cloud security data to detect indicators of compromise and attack.
• Develop and refine hunting methodologies, playbooks and standard operating procedures.
• Create and enhance detection use cases, analytics rules and hunting queries within SIEM and EDR platforms.
• Support Incident Response teams with investigative findings, root‑cause analysis and threat attribution.
• Collaborate with Security Operations, Threat Intelligence, Vulnerability Management and Infrastructure teams to strengthen overall security posture.
• Prepare technical reports, executive summaries and recommendations for continuous security improvement.
• Provide guidance on threat hunting best practices, detection strategies and emerging attack techniques.

Required profile

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering or related field, or equivalent professional experience.
• 7+ years of experience in cybersecurity operations, threat hunting, incident response or detection engineering.
• Proven hands‑on experience leading proactive threat hunts in enterprise‑scale environments.
• Strong knowledge of threat hunting methodologies, cyber kill chain, MITRE ATT&CK and adversary TTPs.
• Relevant certifications such as SC‑200, GCTI, GCIH, GCFA, CISSP, CISM or similar.

Required skills

• Endpoint Detection and Response platforms (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, Cortex XDR).
• Security Information and Event Management (SIEM) and query languages (KQL, SPL).
• Analysis of Windows, Linux, Active Directory, cloud and network telemetry.
• Threat intelligence platforms, IOC analysis and malware behavior analysis.
• Development of detection rules, hunting queries and use cases.