Senior Threat Hunter | Cyber Defense & Resilience | Romania

General Information

Position

Senior Threat Hunter | Cyber Defense & Resilience | Romania

Work arrangement

Full-time

City

Bucharest

Country

Romania

Department

Consulting

Team

Cyber

Area of interest

AI - Artificial Intelligence, Consulting, Cyber, IT - Development, IT - Services, Project & Programme Management, Research & Development, Risk & Regulatory Management

Way of work

Remote

Description & Requirements

Who we are looking for

We are looking for a Senior Threat Hunter to strengthen our SOC’s Threat Hunting team and proactively identify threats across enterprise IT and Operational Technology (OT) environments. You will combine investigative expertise with a strong understanding of adversary behaviour to uncover threats that existing security controls may have missed.

Must have:

• Proven experience in threat hunting, advanced SOC investigations, incident response or detection engineering, including independently leading complex investigations.
• Strong understanding of attacker tactics, techniques and procedures, including persistence, lateral movement, credential abuse and command-and-control activity.
• Hands-on experience with SIEM, EDR/XDR and network security technologies, with proficiency in query languages such as KQL or SPL.
• Strong knowledge of Windows and Linux environments, enterprise networking, Active Directory, cloud platforms and identity security.
• Experience using threat intelligence and MITRE ATT&CK to develop hunting hypotheses and guide investigations.
• Ability to analyse endpoint and network evidence, correlate multiple data sources and distinguish malicious activity from legitimate behaviour.
• Practical scripting skills in Python, PowerShell or a comparable language for investigation and automation.
• Clear written and verbal communication, strong analytical judgement and the ability to collaborate with SOC, IT and OT stakeholders.

Nice to have:

• OT/ICS security expertise , including familiarity with industrial architectures, PLCs, HMIs, SCADA systems, industrial protocols and IT/OT connectivity.
• Experience with OT monitoring platforms, passive network analysis and MITRE ATT&CK for ICS.
• Relevant certifications such as GIAC GCFA, GCIA, GCTI or GICSP. Equivalent practical experience is equally valued.

Your future role

• Lead hypothesis-driven threat hunts to identify malicious activity, compromised identities and previously undetected threats across IT and OT environments.
• Analyse endpoint, network, identity, cloud and security platform telemetry to uncover suspicious behaviour and reconstruct attacker activity.
• Translate threat intelligence, emerging attack techniques and business risks into actionable hunting scenarios.
• Investigate potential threats, assess their scope and impact, and collaborate with SOC analysts and Incident Response teams on escalation and response.
• Partner with OT security and engineering teams to investigate industrial environments while respecting operational safety, availability and change-control requirements.
• Develop and refine hunting queries, scripts and reusable investigation techniques, turning successful hunts into detection improvements.
• Identify telemetry and visibility gaps and recommend improvements to logging, monitoring and security coverage.
• Document and communicate hunt findings, evidence, limitations and remediation recommendations to technical and management stakeholders.
• Mentor analysts and contribute to the team’s hunting methodology, knowledge base and continuous improvement.

What we offer

Join us and become a part of an expert team , working on innovative cybersecurity projects for leading clients around the world. Gain valuable experience with the latest security technologies while driving impactful solutions that make a real difference. Play crucial role in shaping and delivering cyber-domain projects , while continuously expanding your knowledge and skills in a supportive environment that values professional growth.

Fringe benefits:

• Working in Remote work, with occasional in-office days for client visits / other activities
• Flexible Benefits Plan – an allowance per month for benefits (eg medical subscription, meal tickets, private pension).
• 2 additional days off per year for medical leave without a medical certificate.
• Comprehensive travel insurance (both work and personal travel).
• Days off for special personal events, accordingly to the Internal Regulations.
• Bookster subscription.
• Learning & Development : LinkedIn Learning, Udemy for Business, getAbstract.
• The employee assistance program: 24/7 consultancy (financial, psychological, legal).
• Teleworking allowance.

About the team

You will join our SOC’s Threat Hunting team, focused on proactively identifying threats across enterprise IT and OT environments. The team works with SOC analysts, Incident Response specialists, and OT security and engineering stakeholders to investigate suspicious activity, improve security visibility and translate hunting findings into stronger detections.

#LI-AN2