Principal Threat Hunting Engineer (49)

Summary

Proactively defending Elastic's products and services, the full-time Principal Threat Hunting and Emulation Engineer will lead structured threat hunting operations, design adversary emulation exercises, and collaborate with cross-functional teams to enhance detection capabilities in a remote environment.Key responsibilitiesLead hypothesis-driven threat hunting operations across various environments using established frameworksDesign and execute adversary emulation exercises to validate detection pipelines and identify coverage gapsTranslate findings from hunts into production-ready detections, ensuring collaboration with Detection EngineeringRequired qualificationsAt least 8 years of experience in information security, focusing on threat hunting and detection engineeringDemonstrated experience conducting structured threat hunts in complex enterprise or cloud-native environmentsFamiliarity with threat hunting frameworks such as PEAK and TaHiTIExperience designing and executing adversary emulation exercises or purple team engagementsWorking knowledge of adversary TTPs and ability to map threat intelligence to hunt hypotheses

Job Description

Proactively defending Elastic's products and services, the full-time Principal Threat Hunting and Emulation Engineer will lead structured threat hunting operations, design adversary emulation exercises, and collaborate with cross-functional teams to enhance detection capabilities in a remote environment.Key responsibilitiesLead hypothesis-driven threat hunting operations across various environments using established frameworksDesign and execute adversary emulation exercises to validate detection pipelines and identify coverage gapsTranslate findings from hunts into production-ready detections, ensuring collaboration with Detection EngineeringRequired qualificationsAt least 8 years of experience in information security, focusing on threat hunting and detection engineeringDemonstrated experience conducting structured threat hunts in complex enterprise or cloud-native environmentsFamiliarity with threat hunting frameworks such as PEAK and TaHiTIExperience designing and executing adversary emulation exercises or purple team engagementsWorking knowledge of adversary TTPs and ability to map threat intelligence to hunt hypotheses