NCC Group

Global cyber security and resilience provider

Threat Hunter

Security Operations & Incident ResponseUpdated on Nov 13

Full-timeMadrid, SpainNo salary listedHybrid

About the Job

Requirements

Experience in a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysis, or Blue Team role.
Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation.
Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies.
Ability to work autonomously while collaborating across security, engineering, and business teams.
Strong scripting and query language skills, such as Python, KQL, SQL, or PowerShell.

Responsibilities

Use the HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
Leverage GitLab, Sigma, Jupyter Notebooks, and other tools to automate hunts, visualize results, and create reusable artifacts for future investigations and detections.
Collaborate with detection engineering to convert threat hunt findings into high-fidelity detection content.
Use internal and open-source threat intelligence feeds to operationalize detections for emerging threats.
Support mapping threat models to monitoring use cases in partnership with teams across the business.
Document and maintain a repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling.
Provide regular reports and presentations to stakeholders, clearly articulating threats, methods, and risk impact.
Proactively hunt and analyze advanced threats across customers’ environments using the proprietary hunting framework, aligning threat models and hunts to customer needs.
Search for cyber threats that evade traditional security solutions through intelligence-led, hypothesis-driven analysis of TTPs and behaviors, working cross-functionally with Security Operations Centre Analysts, Global Detection Engineers, the Privacy Team, and the Engineering Team to mitigate risks.

Desired Qualifications

Hands-on experience using Jupyter Notebooks for data exploration, automation, and visualization in a security context.
Knowledge of cloud products and log events, including Azure, Amazon Web Services, and Google Cloud Platform.
Familiarity with data science and machine learning techniques in security analysis.
Background in building automated hunting pipelines and/or detection-as-code.
Experience in threat hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of MITRE ATT&CK and the ability to detect and investigate advanced threats beyond signature-based solutions.
Experience using one or more of Splunk, Microsoft, CrowdStrike, and SentinelOne SIEM and EDR stacks.
Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalize findings.
Comfort presenting findings to stakeholders and documenting methodologies.
Desirable certifications include GCFA, OSCP, GDAT, GCIH, or similar.

We are seeking a highly capable and hands-on Threat Hunter to join a passionate and motivated, industry-leading team focused on identifying sophisticated adversaries through hypothesis-driven analysis and automation. You will be responsible for proactively hunting and analysing advanced threats across the customers environment using our proprietary hunting framework, ensuring our threat models and threat hunts are tightly aligned to the customer.

As a Threat Hunter, you will actively search for cyber threats that evade traditional security solutions. Your role will involve conducting in-depth intelligence-led, hypothesis-driven analysis of TTPs and behaviours, and working cross-functionally with the Security Operations Centre Analysts, Global Detection Engineers, Privacy Team and Engineering Team to mitigate risks.

Use NCC Group’s HITS Framework, threat intelligence, MITRE ATT&CK, and risk models to form hypotheses and validate them through structured hunts.
Leverage GitLab, Sigma, Jupyter Notebooks and other tools to automate hunts, visualise results, and create reusable artifacts for future investigations and detections.
Collaborate with detection engineering to convert threat hunt findings into high fidelity detection content.
Utilising both NCC Groups internal threat intelligence feeds and open-source threat intelligence, use these to operationalise detections for emerging threats.
Support the mapping of threat models to monitoring use cases in partnership with teams across the business.
Document and maintain a robust repository for hunting methodologies, tooling, and findings to enable continuous improvement and team scaling.
Provide regular reports and presentations to stakeholders, with clear articulation of threats, methods, and risk impact.

The ideal candidate is a highly skilled and proactive Threat Hunter with a strong background in hypothesis-driven hunting, adversary TTP analysis, and cross-functional collaboration.
They have hands-on experience in Threat Hunting, Red Team, Blue Team, or Incident Response roles, with a deep understanding of the MITRE ATT&CK framework and a proven ability to detect and investigate advanced threats beyond signature-based solutions.
Experienced using one or more of Splunk, Microsoft, CrowdStrike and SentinelOne SIEM and EDR stacks.
Experience translating threat intelligence into actionable insights and working alongside detection engineers and security analysts to operationalise findings.
They should be driven by curiosity and methodical thinking, constantly seeking to improve visibility and detection coverage across complex environments—including hybrid or cloud-native architectures like AWS, Azure, or GCP.
They will be comfortable presenting findings to stakeholders and documenting methodologies.
They thrive in fast-moving, varied and dynamic environments and are passionate about staying ahead of evolving threats.

Minimum Requirements

Experience within a Threat Hunter, Red Team, Incident Response, Threat Intelligence, Malware Analysisor Blue Team role.
Solid understanding of the MITRE ATT&CK framework, TTP analysis, and adversary emulation.
Deep familiarity with hypothesis-driven threat hunting frameworks and methodologies.
Ability to work autonomously while collaborating across security, engineering, and business teams.
Strong scripting/query language skills (e.g., Python, KQL, SQL, PowerShell).

Desirable Requirements

Hands-on experience using Jupyter Notebooks for data exploration, automation, and visualization in a security context.
Knowledge of cloud products and log events such as Azure, Amazon Web Services, Google Cloud Platform.
Familiarity with data science and machine learning techniques in security analysis.
Background in building automated hunting pipelines and/or detection-as-code.

Desirable Certifications

GCFA
OSCP
GDAT
GCIH
Or similar certifications, not required but certainly desirable.

About the Company

NCC Group

Global cyber security and resilience provider

NCC Group provides cyber security and resilience services to organizations and governments around the world. It helps protect digital systems by offering a range of capabilities such as security testing, risk assessment, and resilience planning, backed by a global team of experts and supported by technology-enabled tools. The company’s approach combines human expertise with technical solutions to identify vulnerabilities, assess risk, and implement concrete steps to improve security and continuity. What sets NCC Group apart is its large, worldwide team and its emphasis on practical, end-to-end cyber resilience—working with clients from assessment through to implementation and ongoing assurance. The goal is to create a more secure digital future by helping customers manage cyber risk, reduce threats, and maintain business continuity at scale.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Manchester, United Kingdom
Founded: 1999

Recently Posted Jobs

Explore more opportunities at NCC Group

See more jobs