Security Analysis Threat Hunter - Plano, TX Hybrid
NTT DATA is seeking a Security Analysis Threat Hunter to join our team in Plano, Texas (hybrid role, 4 days per week on-site at the client site). Only local candidates will be considered.
About the role
The Threat Hunting function identifies and validates suspicious or malicious activity. Threat Hunters focus on detection, validation, and enablement of defensive controls through hypothesis-driven, intelligence-led, and MITRE ATT&CK–aligned threat hunting. This role collaborates closely with SOC, SIEM, Vulnerability Management, and Incident Response teams to improve detection coverage, reduce attacker dwell time, and enhance NTT DATA’s managed security services capabilities.
Responsibilities
- Conduct hypothesis-driven and tactic-based threat hunts aligned to the MITRE ATT&CK framework.
- Identify low-and-slow, post-compromise attacker behavior not detected through automated alerts.
- Ingest and operationalize internal and external threat intelligence into hunting hypotheses.
- Develop and execute advanced threat hunting queries across SIEM, EDR, and security analytics platforms.
- Collaborate with SOC, SIEM, and Incident Response teams to escalate confirmed threats and support containment.
- Identify telemetry gaps and work with engineering teams to improve visibility and logging.
- Feed validated hunt results into detection engineering, threat briefs, and use-case improvements.
- Participate in threat hunt working sessions, operational reviews, and customer-facing discussions as required.
Tools & Techniques
- SIEM platforms and log analytics tools
- Endpoint Detection and Response (EDR/XDR) solutions
- MITRE ATT&CK Navigator and DETT&CT
- Threat hunting notebooks, scripts, and automation frameworks
- Internal and open-source threat intelligence feeds
Requirements
- 10+ years’ experience in Cyber Security
- Strong understanding of adversary tactics, techniques, and procedures (TTPs).
- Hands-on experience performing structured threat hunts in enterprise environments.
- Proficiency with SIEM query languages and endpoint telemetry analysis.
- Ability to translate threat intelligence into actionable security detections.
- Strong written and verbal communication skills for technical and executive audiences.
Preferred Qualifications
- GIAC Certified Threat Intelligence (GCTI)
- GIAC Certified Incident Handler (GCIH)
- CompTIA CySA+
- Certified Ethical Hacker (CEH)
Key Performance Indicators (KPIs)
- Number of proactive threat hunts executed per reporting period
- High-confidence threats identified without prior alerts
- Reduction in attacker dwell time through proactive discovery
- Percentage of hunt findings operationalized into detection rules
- Coverage improvement against MITRE ATT&CK techniques
- Mean time to escalate verified threats to Incident Response
- Quality and clarity of threat hunt reports and recommendations
Pay
The starting pay range for this role is $106,575 – $177,625. Actual compensation will depend on relevant experience, technical skills, and other qualifications. This position may also be eligible for incentive compensation based on individual and/or company performance.
Benefits
- Medical, dental, and vision insurance with employer contribution
- Flexible spending or health savings account
- Life and AD&D insurance
- Short and long term disability coverage
- Paid time off
- Employee assistance program
- 401k program with company match
- Additional voluntary or legally-required benefits
About NTT DATA
NTT DATA is a $30 billion business and technology services leader, serving 75% of the Fortune Global 100. We accelerate client success and positively impact society through responsible innovation. As a Global Top Employer, we have experts in more than 50 countries and offer clients access to a robust ecosystem of innovation centers as well as established and start-up partners. NTT DATA is part of NTT Group, which invests over $3 billion each year in R&D.