Back to SearchLead Threat Researcher / Threat Hunter
Hybrid in Republic of Lithuania, Latvia
Security.Operations& 12 others
Looking for something else?
Find a vacancy that works for you. Send us your CV to receive a personalized offer.
Find me a job
Choose an option
We are partnering with a vulnerability intelligence and exposure management company that is looking for a Lead Threat Researcher / Threat Hunter to track adversary activity, analyze vulnerabilities and exploits, and turn findings into actionable intelligence and detections for their platform and customers.
Responsibilities
- Research emerging threats, threat actors (APT, ransomware groups) and their TTPs, mapped to MITRE ATT&CK
- Analyze newly disclosed CVEs, assess exploitability and weaponization status, and prioritize by real-world risk (KEV, EPSS, exploit availability)
- Run hypothesis-driven threat hunts across endpoint, network and cloud telemetry
- Build and tune detection content (Sigma, YARA, Snort/Suricata, SIEM queries)
- Reverse engineer malware samples and exploit code (static and dynamic) to extract IOCs and behaviors
- Monitor OSINT, dark web and underground sources for threat signals
- Write intelligence reports, advisories and blog posts for technical and executive audiences
- Contribute research data and logic to the client's intelligence platform and AI/automation workflows
Requirements
- 5+ years of experience in threat intelligence, threat hunting, SOC/IR or security research
- Knowledge of MITRE ATT&CK, Cyber Kill Chain and Diamond Model
- Hands-on expertise in vulnerability analysis: CVE/CVSS/CWE, EPSS, CISA KEV, including exploit validation
- Background in detection engineering with Sigma, YARA and Snort/Suricata
- Proficiency in SIEM querying (Splunk SPL, KQL or Elastic)
- Understanding of malware analysis fundamentals using IDA/Ghidra, sandboxes and x64dbg
- Skills in scripting for automation and data analysis with Python
- Familiarity with threat intel platforms and standards (MISP, OpenCTI, STIX/TAXII)
- Strong technical writing skills in English (B2+ level)
Nice to have
- Published research, CVE credits or conference talks
- Experience in reverse engineering of exploits/PoCs and exploit development
- Competency in EDR/XDR hunting (CrowdStrike, SentinelOne, Defender)
- Expertise in cloud threat hunting across AWS, Azure and GCP logs
- Flexibility to use LLMs for threat research automation
- Certifications: GCTI, GCIH, GREM, GCFA, OSCP or CTIA