Threat Investigator

Responsibilities: of the Threat Investigator: • Write and optimize complex SPL (Search Processing Language) queries from scratch to identify threats, hunt for malicious activity, and improve detection capabilities. • Leverage UEBA technologies to analyze user and entity behaviors, identify anomalies, and investigate potential security incidents. • Support CSIRT operations by conducting threat investigations, triaging alerts, and assisting with incident response efforts. • Develop and maintain Splunk dashboards, reports, correlations, and detection content to enhance visibility across the environment. • Collaborate with security engineering and operations teams to improve threat monitoring, detection, and response processes. Qualifications: of the Threat Investigator: • 4+ years of experience in threat hunting, threat investigation, incident response, or cybersecurity operations. • Expert-level experience with Splunk, including advanced SPL development and dashboard creation. • Strong hands-on experience with UEBA platforms and behavioral analytics methodologies. • Experience supporting CSIRT functions and investigating complex security incidents across enterprise environments. • Knowledge of MITRE ATT&CK, threat intelligence, and modern detection engineering practices.