Threat Hunter
About the job
- At least 5 years of experience in cybersecurity operations, incident response, threat hunting, or related defensive security roles.
- Hands-on experience performing threat hunting, detection analysis, and investigation work across enterprise environments.
- Strong knowledge of incident response processes, including scoping, containment, remediation planning, and post-incident improvements.
- Experience with security platforms such as endpoint detection and response (EDR), security information and event management (SIEM), security orchestration, automation and response (SOAR), threat intelligence platforms, or similar technologies.
- Direct customer-facing experience providing security guidance, technical support, or operational enablement.
- Proficiency with scripting or application programming interface (API) usage, such as Python, PowerShell, or REST APIs, for integrations and data-driven investigations.
- Understanding of threat intelligence concepts, detection engineering principles, and threat visibility best practices.
- Ability to collaborate cross-functionally with product, engineering, and security teams to translate customer needs into actionable improvements.
- Native-level fluency in Japanese and business-level proficiency in English are required.
- Strengthen customer incident response readiness, assist with remediation planning, and augment response capabilities during incidents to improve customers' overall security maturity and readiness.
- Perform hands-on threat hunting with customers, executing the full hunting lifecycle to detect, investigate, and reduce emerging threats.
- Provide expert deployment and enablement of Tanium Security Operations solutions tailored to each customer's use cases.
- Conduct threat intelligence analysis, build and refine detections, and tune intelligence with customers to enhance threat visibility and response.
- Work side by side with customers in a hands-on-keyboard capacity to guide, support, and maximize the effectiveness of the Tanium Platform.
- Collaborate with internal product teams, providing customer-driven feedback and hands-on insights to shape and enhance the Tanium Platform.
- Build API-driven integrations with third-party tools and create custom Tanium hunts using the API to baseline and enhance customer threat visibility and capability.
- Partner with internal teams to research emerging security challenges, such as AI, container and cloud security, and operational technology (OT), to inform customer guidance and platform improvements.
About the company
Tanium provides endpoint security and IT systems management using the Tanium XEM platform. The platform gives real-time visibility and control over endpoints across an organization, allowing teams to see all devices, applications, and configurations and to take actions quickly. It works by deploying lightweight agents on endpoints that continuously collect data and respond to guided queries from a centralized console, enabling tasks like asset discovery, vulnerability assessment, patching, and remediation at scale. Compared to competitors, Tanium emphasizes real-time, large-scale visibility and control across heterogeneous environments, including government, financial, and retail sectors, with a single platform that integrates security and IT operations. The company's goal is to help organizations protect their critical assets and manage their IT environments with certainty and precision.
Company Size
1,001-5,000
Company Stage
Late Stage VC
Total Funding
$805.7M
Headquarters
Bellevue, Washington
Founded
2007
Get referred to Tanium
See people who can refer or advise you
Simplify's Take
What believers are saying
- Black Hat 2026 launched Background AI Agents and Agentic Performance Analysis.
- Tanium's Microsoft Defender, Sentinel, and Intune integrations deepen enterprise distribution now.
- Founder-led reset and 2026 analyst recognition strengthen credibility with defense and financial buyers.
What critics are saying
- September 2026 advisories fixed critical SQL injections in Tanium Asset and Threat Response.
- Five top executives left in May 2026, signaling leadership churn before any IPO.
- CrowdStrike and Microsoft keep compressing Tanium's edge; missed AI execution risks permanent share loss.
What makes Tanium unique
- Orion Hindawi returned as CEO on August 21, 2026, doubling down on Autonomous IT.
- Tanium Atlas now governs agentic AI across endpoints, Microsoft Security Copilot, and Claude.
- Real-time endpoint control at enterprise scale remains Tanium's clearest moat versus point tools.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Insurance, Health & Wellness Package
401k Plan, Stock Options, Equity Incentive Plan, and Performance Bonus
Work From Home
Maternity & Paternity Leave
Adoption Assistance
Flexible Hours
Paid Time Off
Free Lunch or Snacks
Company Social Events
Travel Concierge
Commuter Checks & Assistance
Employee Discount
Tuition Assistance
Growth & Insights and Company News
6 month growth
2%1 year growth
1%2 year growth
1%Tanium relaunches Security Operations to counter AI attacks. Fri, 9th Oct 2026 (Today) Tanium has relaunched its Security Operations product, positioning the update to address attacks shaped by artificial intelligence. The relaunch focuses on combining detection, response and threat hunting in a single workflow tied to endpoint data already used by IT teams. The product is designed to work alongside existing security information and event management and endpoint detection and response tools, rather than replace them. Tanium argues that attackers are increasingly using stolen credentials and common administrative tools instead of malware, making them harder to detect with systems focused on known malicious files. In response, the updated product looks for unusual behaviour on devices and lets security teams take action across large numbers of endpoints from the same platform. Among the additions is Endpoint Drift, which learns how individual endpoints normally behave and flags machines operating outside those patterns. Tanium also introduced an Insights Engine, replacing its previous process injection detection approach with a system intended to identify attackers hiding inside trusted processes. On the response side, analysts can stop a single process, collect forensic evidence or isolate a host on one machine or across a wider estate. Tanium also introduced a Federated SOC model that allows separate security teams to use one platform while keeping their own suppression settings and automated response rules separate. Hunting focus Another part of the relaunch is Tanium Atlas, which is intended to broaden access to threat hunting beyond specialist teams. Analysts can submit questions in plain language, receive answers from endpoints in seconds and take action within the same interface. Hunt strategies created by Tanium's own threat hunters are built into the workflow. Atlas can also rank alerts and recommend whether analysts should dismiss, escalate, investigate further or contain them, while new dashboards and templates are intended to give teams a starting point. "AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," said Harman Kaur, Chief Technology Officer at Tanium. "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era," Kaur said. Tanium is also offering HuntIQ, a service that pairs Tanium threat hunters with the same platform and artificial intelligence tools used in the product. According to the company, those teams work inside customer environments to identify threats, refine detections and support incident response. HuntIQ teams can also build hunts before a patch or common vulnerabilities and exposures entry exists. Tanium cited FalconFlank as an example of a zero-day case in which this approach had been used. Market pressure The relaunch comes as security vendors adapt products to address attacks that unfold more quickly and often rely on legitimate tools already present in enterprise environments. That shift has increased the emphasis on near real-time visibility at the endpoint and faster action once suspicious behaviour is identified. Dave Gruber, Chief Analyst at Omdia, said the speed of modern attacks is exposing the limits of many current security operations processes. "The AI-fueled threat landscape has changed the dynamics of security operations," said Dave Gruber, Chief Analyst at Omdia. "Speed is more important than ever before, as attack execution speeds outpace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures." Tanium said the updated Security Operations offering is available now, tying the relaunch to a broader strategy that links endpoint management and security operations through the same underlying platform and data.
Tanium relaunches security platform to counter AI attacks. Wed, 7th Oct 2026 (Yesterday) Tanium has relaunched its Security Operations platform to address attacks that use stolen credentials and standard administrative tools rather than malware. The updated product combines detection, response and threat hunting in a single workflow built on endpoint data already used by IT teams. It is designed to work alongside existing security information and event management and endpoint detection and response products, not replace them. The relaunch reflects a wider shift in cybersecurity as attackers rely less on malicious files and more on legitimate tools already present on corporate machines. That can make intrusions harder to spot because the activity may resemble routine work by internal administrators. One new element, Endpoint Drift, is intended to identify devices behaving outside their normal pattern. Another, Insights Engine, is designed to detect attackers operating inside trusted processes, replacing Tanium's previous process injection detection approach. Response functions have also been expanded so security teams can take action across large numbers of devices. Those actions include stopping a process, gathering forensic evidence and isolating a host on individual machines or across a wider estate. Tanium has also introduced what it calls a Federated SOC model. Under that setup, separate security teams can use the same platform while maintaining different suppression rules and automated response settings for their own environments. Another part of the relaunch focuses on threat hunting, an area often limited to experienced analysts because of the time and skill involved. Tanium said its Atlas tool allows analysts to ask questions in plain language, receive answers from endpoints in seconds and take follow-up action from the same interface. Atlas also prioritises alerts and suggests whether each should be dismissed, escalated, investigated through a hunt or contained. Tanium has added security operations dashboards and templates intended to give teams a starting point for these workflows. Harman Kaur, Chief Technology Officer, Tanium, said the changes were a response to the way artificial intelligence is reshaping attacker behaviour. "AI has changed who the attacker is and how fast they move. The next breach won't look like malware. It will look like one of your own administrators," Kaur said. She added: "We have spent years learning what normal looks like on every endpoint our customers run. Now we use that to catch what doesn't belong and stop it everywhere at once. That is what security operations has to become in the AI era." Market shift Tanium argues that many established security tools were built to identify known malicious files or signatures, while newer attacks may begin with a valid login and spread using built-in administration tools. In response, vendors are placing more emphasis on behaviour-based detection and rapid response tied to live endpoint telemetry. That shift has also driven greater interest in automation inside security operations centres, particularly as teams face large alert volumes and pressure to respond more quickly. Tanium is positioning its updated platform around that demand while stressing that automated actions remain governed by user-defined rules. External analysts broadly share the view that the operational tempo of attacks has increased. Dave Gruber, Chief Analyst, Omdia, said, "The AI-fueled threat landscape has changed the dynamics of security operations." He continued: "Speed is more important than ever before, as attack execution speeds out pace current security operations mechanisms and processes. Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures." Services link Alongside the platform update, Tanium is also highlighting HuntIQ, a service that pairs its threat hunters with customer environments. The company said those specialists use the same platform and artificial intelligence tools to search for threats, improve detections and support incident response. Tanium said lessons from that work are fed back into the product, including hunts created before a patch or common vulnerability and exposure reference is available. It cited its response to the FalconFlank zero-day as an example of that model. The relaunch underlines how endpoint-focused vendors are trying to move beyond device management and traditional detection by tying together visibility, investigation and remediation. For security teams, the key test will be whether those integrated workflows reduce response times without adding to the operational burden of already crowded toolsets. The updated Security Operations offering is available now.
Tanium unveils New SecOps capabilities. Tanium expands SecOps with real-time endpoint intelligence, AI-native hunting and agentic response to detect, investigate and contain threats faster. Oct 6, 2026 Channel Insider content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More Tanium has announced new security operations capabilities that give IT and security operators greater detection depth, response options, and AI-native hunting to investigate, contain, and resolve threats faster within live endpoint intelligence. The Tanium Security Operations capabilities are powered by Tanium Atlas, the company's autonomous operating system that allows customers to build a self-driving SOC that runs autonomously within the guardrails an operator sets. Tanium expands SIEM and EDR with live endpoint data. Tanium Security Operations enables IT and security operators to reason over the endpoint as it currently exists, extend existing SIEM and EDR investments, and act from a single platform. The portfolio of capabilities combines real-time visibility across managed endpoints and the ability to act safely at speed and scale. It features three pillars: * Detection depth and data fidelity: Threat detection against live endpoint state, not aged data. New Endpoint Drift surfaces abnormal behavior relative to historical baselines, and the Insights Engine detects advanced in-memory techniques, delivering faster, more focused hunting and better prioritization of suspicious activity across the fleet, with faster protection delivery. * Diverse response: Tanium pairs detection with a full spectrum of response options executed directly on the endpoint, from quarantining hosts to collecting forensic evidence. A new Federated SOC architecture lets operators work independently on a single platform, backed by a modernized Windows quarantine designed for agentic SOC actions and safer multi-team operations. * AI-native hunting: Tanium Atlas helps IT and security operators investigate threats, prioritize alerts, and determine next steps. With New Alert Prioritization and Triage, the queue is ranked to recommend whether to dismiss, escalate, hunt, or contain, resulting in faster alert-to-decision time, less analyst fatigue, and fewer low-value alerts. New SecOps dashboards and templates make expert-level hunting faster to scale. "Security teams don't need another tool that generates more alerts. They need the truth about what's happening on their endpoints right now, and the power to act on it before an attacker does," said Harman Kaur, CTO, Tanium. "Tanium Atlas brings live endpoint intelligence and agentic AI together so operators can detect what is abnormal, investigate it in context, and respond immediately. The customer sets the rules and autonomy runs the workflow." Google Threat Intelligence adds investigation context. These new integrations deepen the context provided by live endpoint data. Google Threat Intelligence in Tanium SecOps brings premium intelligence directly into investigation and hunting workflows, while multi-provider reputation intelligence from five leading providers reduces false positives and accelerates triage. "The AI-fueled threat landscape has changed the dynamics of security operations," said Dave Gruber, chief analyst at Omdia. "Speed is more important than ever before, as attack execution speeds outpace current security operations mechanisms and processes." "Agentic capabilities can speed detection and response, but without access to near real-time telemetry and response, agentic SOC capabilities still lag attacker activities. Tanium's approach of grounding detection and hunting in real-time endpoint state addresses one of the most persistent gaps in enterprise SOC architectures," Gruber added. HuntIQ combines threat hunters with agentic AI. Additionally, Tanium HuntIQ combines security research, expert threat hunters, and agentic AI built on Tanium Atlas for organizations that want to further minimize risk. Tanium HuntIQ experts work directly within customer environments to identify threats, strengthen detections, and support incident response. The findings are then fed back into the platform so that every subsequent hunt starts in a more intelligent place. What Tanium's SecOps expansion means for MSPs. For MSPs and MSSPs, the bigger opportunity is operational. Tanium is combining live endpoint telemetry, AI-assisted alert prioritization, threat hunting, and response into a single SecOps workflow, which could help providers reduce the manual effort of correlating alerts across multiple tools. The new capabilities include endpoint-level response actions and a Federated SOC architecture designed to support separate teams working from a shared platform. That fits a broader trend Channel Insider has been tracking around platform consolidation and agentic SecOps. As security providers look to expand managed detection and response and threat hunting without growing analyst headcount at the same rate, automation becomes more valuable when it is grounded in current endpoint data rather than in another layer of alerts. For Tanium partners, that could create room to build more advanced managed security services around Atlas and SecOps, although the announcement does not detail MSP-specific packaging, multi-tenancy, or partner economics. Jordan Smith is an enterprise technology and cybersecurity journalist with nearly a decade of experience covering B2B IT, federal technology, artificial intelligence, cybersecurity, cloud computing, and emerging digital trends. His reporting helps business and technology leaders understand how new technologies, security challenges, and infrastructure decisions affect modern organizations. Jordan has reported on enterprise and public-sector technology for TechnologyAdvice, HCLTech, MeriTalk, and Channel Insider. His background spans cybersecurity, cloud infrastructure, AI adoption, digital transformation, and federal IT initiatives, giving him a broad perspective on the tools, policies, and innovations shaping today's technology landscape. Before joining TechnologyAdvice, Jordan served as a Senior Technology Reporter at MeriTalk, where he covered the federal IT space, and later worked as a US Regional Reporter and Copy Editor/Writer for HCLTech. His experience across reporting, copyediting, podcasting, and event moderation allows him to translate complex technical topics into clear, timely, and useful insights for business audiences. Jordan holds a Master of Arts in Journalism from the University of Nebraska-Lincoln and a Bachelor of Science in Criminal Justice and Psychology from Edgewood University. Through his work, he helps readers stay informed about cybersecurity developments, enterprise technology trends, and the business impact of emerging IT solutions.
Critical vulnerabilities in Check Point, Kaspersky, and Tanium patch products. Post Views: 8 Check Point, Kaspersky, and Tanium have addressed critical flaws in their software solutions, including vulnerabilities that could enable remote code execution. Check Point vulnerabilities. Check Point's Security Management and Log Server systems were found to have a flaw designated CVE-2026-91843. This vulnerability allows an unauthenticated attacker to execute arbitrary code with elevated privileges during the login process. While no evidence of active exploitation has been confirmed, the vendor has released indicators of compromise to help identify potential breaches. Users without automatic update mechanisms are urged to apply patches immediately. CVE-2026-91843 details. This flaw enables an unauthenticated attacker to execute arbitrary code with elevated privileges during the login process. The vendor has provided indicators of compromise to assist in detecting potential breaches. Kaspersky vulnerabilities. Kaspersky issued a security advisory on September 17 highlighting a Redis-related vulnerability impacting Kaspersky Security 10 for Linux Mail Server. Discovered in 2023, the flaw could lead to system instability or arbitrary code execution when processing specific file formats. The vendor emphasized the potential for attackers to exploit this weakness to compromise affected systems. Redis-Related flaw. The Redis-related vulnerability (unspecified CVE) could allow attackers to cause system instability or execute arbitrary code when processing specific file formats. The flaw was discovered in 2023 but remains a critical risk for affected systems. Tanium security advisories. Tanium disclosed five security advisories this week, detailing high- and medium-severity issues across its product line. In Tanium Asset, two critical SQL injection vulnerabilities were resolved, which could have permitted authenticated attackers to access restricted data or manipulate database queries. A separate SQL query tampering flaw was also addressed in Threat Response. Additional updates included fixes for two medium-severity issues: a server-side request forgery vulnerability that could expose sensitive information and an improper access control flaw enabling unauthorized alert modifications. SQL injection and tampering issues. Tanium Asset resolved two critical SQL injection vulnerabilities, while Threat Response addressed a separate SQL query tampering flaw. These issues could have allowed authenticated attackers to access restricted data or manipulate database queries. Medium-Severity fixes. Tanium also resolved a server-side request forgery vulnerability and an improper access control flaw. The former could expose sensitive information, while the latter allowed unauthorized alert modifications. The disclosures follow a broader trend of threat actors targeting software supply chains and enterprise infrastructure. Cybersecurity professionals are advised to review patch management protocols and monitor for signs of exploitation linked to the identified vulnerabilities. Organizations are encouraged to implement proactive mitigation strategies to reduce exposure to these risks.
MIND secures $72M in funding for ai-powered data loss prevention. Post Views: 14 A cybersecurity startup has secured $72 million in funding to advance its AI-driven data loss prevention (DLP) solution. Funding and investment. The investment round was led by Crosspoint Capital Partners, with additional support from YL Ventures and Paladin Capital Group. The company, based in Seattle, launched its AI-native DLP platform in 2024 after emerging from stealth mode. Company's AI DLP Platform. The system is designed to safeguard sensitive data through automated processes that detect and block unauthorized data transfers across enterprise environments. The platform employs multi-layer classification to analyze content and contextual patterns, enabling AI-powered agents to manage DLP workflows. It addresses data exfiltration risks in endpoints, generative AI tools, and software-as-a-service (SaaS) deployments. CEO's statement. "The challenge for security teams is protecting data that moves at AI speed using tools built for a slower era," said MIND's co-founder and CEO Eran Barak. "AI is both amplifying data exposure risks and providing the tools to modernize protection strategies. This is a critical moment to redefine DLP for the AI-driven landscape." Other cybersecurity developments. The funding will support product development, expansion into key enterprise markets, strategic partnerships, and team growth. The company's approach focuses on real-time threat detection, leveraging machine learning to adapt to evolving data movement patterns. Its technology aims to mitigate risks associated with autonomous systems and human actors accessing sensitive information at unprecedented speeds. Other recent developments in the cybersecurity sector include a $40 million funding round for AIUC, which focuses on validating enterprise AI agents, and a $270 million investment in Exein, a firm specializing in physical AI security. Meanwhile, Cisco addressed multiple vulnerabilities in its Firepower Management Center, Identity Services Engine, and Nexus Dashboard, while CISA issued guidance on deploying cyber decoys to bolster infrastructure defenses. A separate report highlighted the discovery of unauthenticated remote code execution flaws affecting over 200,000 WordPress sites, alongside a data breach impacting 280,000 individuals linked to Premier Medical Group. Software updates from Chrome, Firefox, and Acronis addressed 115 vulnerabilities, while Check Point, Kaspersky, and Tanium released patches for product-specific flaws. Recent cyber incidents targeting oil tankers prompted coordinated actions by the U.S. Coast Guard and FBI, and OpenAI disclosed that its models accessed GitHub repositories during training, potentially exposing leaked API keys. CISA also discontinued its weekly vulnerability bulletin in favor of a risk-based approach. A separate breach at Revolut involved 680 high-profile accounts and a $3 million ransom demand. Additional coverage includes updates to ISC's BIND 9 software, a surge in ransomware attacks on manufacturers, and insights on operationalizing continuous authorization at scale. Industry leaders emphasized the need for continuous control monitoring to ensure security measures remain effective, as well as the importance of revocable API keys and treating AI agents as privileged entities. Experts also highlighted the limitations of traditional security data models and the risks of conflating authentication with threat detection.