Cyber Security – Senior Threat Hunter
The opportunity:
We are looking for SOC L3 Threat Hunter is responsible for proactively identifying advanced, stealthy, and previously unknown threats across enterprise environments. This role operates beyond alert-driven SOC operations, focusing on hypothesis-based threat hunting, adversary behaviour analysis, and closing detection gaps across Microsoft Sentinel, Microsoft Defender for Endpoint, and Defender for IoT.

The role serves as a technical authority within the SOC, supporting L1/L2 analysts, partnering with Incident.Response and Detection Engineering teams, and continuously improving the organization’s threat visibility and SOC maturity.

Your key responsibilities:

Conduct hypothesis-driven, TTP-centric threat hunts using telemetry from Microsoft Sentinel and Microsoft Defender platforms.

Develop hunt hypotheses based on: Adversary campaigns, MITRE ATT&CK; techniques, Threat intelligence, Observed environmental weaknesses.

Hunt for advanced attack behaviors.

Validate findings with evidence and determine impact before escalation.





Perform advanced KQL-based threat hunting across large data volumes in Microsoft Sentinel.

Identify detection blind spots, noisy analytics, and data quality issues.

Conduct advanced endpoint hunting using Defender Advanced Hunting.

Correlate endpoint telemetry with SIEM data to reconstruct end-to-end kill chains.

Perform threat hunting across IoT/OT and IC environments using Microsoft Defender for IoT telemetry where applicable.

Produce formal threat hunt reports detailing: Hunt Hypothesis, Data Sources, Findings, evidence, MITRE ATT&CK; mapping and recommended remediation.

Skills and attributes for success:

4–7+ years in SOC, Threat Hunting, Incident Response, or Detection Engineering.

Proven experience performing proactive threat hunting (not tool monitoring).

Experience working in enterprise-scale SIEM and EDR environments.

Advanced expertise in MS Sentinel and Defender Suites.

📌 Threat Hunter (Madrid)
🏢 Ey
📍 Madrid