Role Overview
The Senior Detection Engineering and Threat Hunting Analyst position at Huntress is a remote role based in Australia that suits professionals with a background in threat hunting, security operations, or incident response. This role focuses on tackling difficult security challenges, such as uncovering stealthy intrusions and building resilient detection portfolios to protect millions of endpoints globally.
Key Responsibilities
Manage the entire detection lifecycle by creating, testing, tuning, promoting, and retiring rules based on performance.
Build detection rules across multiple operating systems and Huntress products, including Security Information and Event Management (SIEM), Identity Threat Detection and Response (ITDR), and Endpoint Detection and Response (EDR).
Handle internal and partner-escalated detection and threat hunting requests.
Conduct hypothesis-driven threat hunts across telemetry data to uncover advanced attacker techniques that evade initial defenses.
Transform threat intelligence, Indicators of Compromise (IOCs), and Tactics, Techniques, and Procedures (TTPs) into refined detections using Git-based workflows.
Construct hunting queries and dashboards to identify potential malicious activities and investigate ambiguous signs of attacker behavior.
Contribute findings to public projects and produce educational content like blogs, videos, and podcasts.
Utilize AI-assisted workflows to prototype queries and draft detection rules while validating outputs with sound human judgment.
Requirements
Minimum of two years of professional experience in threat hunting, detection engineering, managed detection and response (MDR), security operations centers (SOC), or incident response.
Intermediate comprehension of Windows internals.
Working familiarity with macOS, Linux, Microsoft 365, Google Workspace, and Azure.
Proven background in writing, testing, tuning, and documenting analytics derived from threat intelligence or investigations.
Competency with detection languages such as YARA, Sigma, Suricata, or Snort, alongside query languages like KQL, EQL, Splunk SPL, or ES|QL.
Strong understanding of adversary tradecraft, including persistence, privilege escalation, lateral movement, and defense evasion.
Familiarity with different threat actor types, such as state-sponsored groups, initial access brokers, and ransomware affiliates.
Ability to build reusable AI workflows for threat analysis and verify generated results prior to production deployment.
Nice to Have
Intermediate understanding of Linux and macOS internal architecture.
Practical experience with remote evidence discovery utilities such as Velociraptor, OSquery, and XDR/EDR/MDR platforms.
Previous utilization of forensic analysis software like RegRipper, Eric Zimmerman's EZ Tools, Chainsaw, or Hayabusa.
Intermediate malware analysis capabilities.
Skills and Tools
Detection Engineering & Threat Hunting
Windows Internals
Azure, Linux, macOS, Microsoft 365, Google Workspace
Sigma, YARA, Suricata, Snort
KQL, EQL, Splunk SPL, ES|QL
Git-based workflows
AI-assisted security workflows
Salary and Benefits
Base compensation range between $150,000 and $170,000 AUD, plus bonus and equity.
Fully remote work environment within Australia.
Annual company trip to the United States for the Summer Summit, plus local Australian events.
New hire home office setup reimbursement of $800 AUD.
Monthly digital allowance of $185 AUD for internet and phone expenses.
Monthly tech stipend of $40 AUD for equipment upgrades.
Twelve weeks of paid parental leave for primary and secondary carers.
Subsidised private health insurance through a preferred provider.
Stock options provided to all full-time staff members.
Membership to the BetterUp platform for personal and professional coaching.
About the Company
Established in 2015 by former NSA cyber operators, Huntress operates as a remote-first organization dedicated to providing enterprise-grade cybersecurity solutions to businesses of all sizes. The company combines in-house technology with a 24/7 human-led Security Operations Center to protect more than five million endpoints and fifteen million identities worldwide.
How to Apply
Candidates should apply directly through the official Huntress careers page.
