Role Overview

Responsible for proactively identifying, investigating, and mitigating advanced cyber threats that evade traditional, alert‑driven security controls. The role focuses on hypothesis-driven and intelligence-led threat hunting across endpoint, network, identity, and cloud environments to reduce dwell time and enhance detection maturity.

Key Responsibilities

- Conduct hypothesis-based and IOC-driven threat hunting across:
- Endpoint (EDR/XDR)
- SIEM / Log Management platforms
- Network telemetry (NDR)
- Identity logs (AD / Entra ID)
- Cloud platforms (Azure, AWS, M365)
- Identify stealthy and advanced threats, including:
- Living‑off‑the‑Land (LotL) techniques
- Advanced Persistent Threats (APTs)
- Lateral movement and privilege escalation
- Insider threat indicators
- Develop and execute MITRE ATT&CK;–aligned hunting hypotheses
- Convert hunting findings into:
- Security incidents
- New detection rules (SIEM / EDR / XDR)
- Change or service requests (misconfigurations, logging gaps)
- Collaborate with SOC, Incident Response,



and Threat Intelligence teams
- Produce hunting reports and KPIs (dwell time reduction, hunts to detections, incidents generated)

Technical Skills

- Strong expertise in SIEM/SOAR platforms (Splunk, Microsoft Sentinel, Chronicle, Palo Alto XSIAM)
- Hands-on experience with EDR/XDR tools (Microsoft XDR, CrowdStrike, SentinelOne, Palo Alto Cortex)
- Proficiency in KQL / SPL / advanced hunting queries
- Deep understanding of MITRE ATT&CK; techniques and TTPs
- Robust OS knowledge: Windows, Linux, macOS
- Basic scripting skills (PowerShell / Python preferred)
- Cloud security exposure (Azure, AWS, M365 Defender)

Experience & Soft Skills

- 6+ years in SOC / Threat Detection, with 2+ years in threat hunting
- Strong analytical and investigative mindset
- Client‑facing reporting and presentation skills
- Willingness to work in 24×7 SOC environments

📌 Cyber Threat Investigator (Bengaluru)
🏢 SISL Global
📍 Bengaluru