Threat Hunting Analyst

Build the Future with AspenView Technology Partners

At AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.

As we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.

Why Join AspenView?

At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.

Here’s what you can expect:

• Competitive base
• Flexible work model: hybrid, remote, or in-office
• Real growth opportunities and leadership visibility
• Inclusive, respectful culture that blends U.S. innovation with Colombian heart
• A company that listens, invests in you, and celebrates wins together

We are seeking a Threat Hunting Analyst to join the security operations team of a large US consumer lender in the financial services sector, based in Bogotá or Buenos Aires in a hybrid model. You’ll build and run hypothesis-driven hunts across endpoint, identity, network, email and AWS telemetry in Elastic, reporting to the Threat Hunting Lead and working closely with Detection Engineering so that every good hunt ends as a working detection. This role suits an analyst who has already gone looking for threats proactively with SIEM queries, even if hunting wasn’t their main job, and who wants to know what living-off-the-land, credential abuse and lateral movement look like in real logs.

What you will do:

Hunt Design & Threat Intelligence

• Build hunts with the Threat Hunting Lead from threat intelligence relevant to US consumer finance, recent incidents and known telemetry gaps.
• Turn intelligence into testable hypotheses and decide which data sources and timeframes will answer each hunt question.
• Map attacker tradecraft to MITRE ATT&CK to shape and prioritize hunts.

Hunt Execution & Investigation

• Run scheduled and ad hoc hunts across CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic.
• Pivot when an initial query surfaces something worth chasing, and separate real findings from noise.
• Escalate live attacker activity to Tier 3 with the evidence attached.
• Run indicator and behaviour sweeps when new intelligence arrives or during major incidents, to scope how far an attacker reached.

Detection Engineering Partnership

• Hand candidate detections to Detection Engineering, written well enough to build from.
• Identify logging gaps and document them for remediation.

Reporting & Knowledge Sharing

• Write clear, reproducible hunt reports covering what was tested, found, ruled out and couldn’t be tested.
• Share findings with the client’s security team, mostly in writing.
• Document hunts so anyone on the team can rerun them.

Tools & Technologies:

• Platforms & Infrastructure: Elastic Security (EQL, ES|QL), Splunk, Microsoft Sentinel, QRadar or equivalent SIEMs, Palo Alto, Proofpoint.
• Security & Threat Intelligence: CrowdStrike Falcon, Microsoft Defender, SentinelOne, MITRE ATT&CK, MISP, OpenCTI, Recorded Future, FS-ISAC.
• Cloud & Data Analysis: AWS (control-plane and cloud telemetry), Okta (identity telemetry), Python, Jupyter.

What you bring:

• Experience: 3+ years as a Tier 2 or Tier 3 SOC analyst, incident responder or threat hunter, including proactive hunts with SIEM queries, even if hunting wasn’t your main role. You can walk through a hunt from hypothesis to outcome, including one that found nothing.
• Technical Depth: Comfortable querying large data sets in Elastic, Splunk, Sentinel or equivalent, with a good grasp of how living-off-the-land, credential and session abuse, lateral movement and cloud control-plane abuse appear in logs.
• Collaboration: Works well with the Threat Hunting Lead, Detection Engineering and the SOC analysts, and is interested in growing into a Threat Hunting Lead or Detection Engineering Lead role.
• Mindset: Rigorous and curious, and knows that a hunt proving a control works is a good result.
• Language: Spoken English at B1 or above, with strong written English, since hunt reports are read by the client’s security team.
• Location & Schedule: Full-time, as a direct AspenView employee dedicated to one client, in a hybrid model based in Bogotá or Buenos Aires: two days a week in AspenView’s office and three from home, plus in-person attendance for important meetings. US Eastern business hours, with no rotating shifts, and occasional call-ins during major incidents.
• Clearance: Must pass identity, criminal-background, employment and education checks, repeated periodically, and work in a clean-desk, VDI-only environment.
• Nice to have: Financial-sector threat experience (fraud-motivated intrusion, ransomware, BEC), detection-writing skills, malware triage or memory forensics, and certifications such as GCTI, GDAT, GCIH, GCFA or eCTHP.

Visa Sponsorship

AspenView does not sponsor employment visas for this role. Applicants must be permanently authorized to work in their country of residence and must not require visa sponsorship now or in the future.