Senior Detection Engineering & Threat Hunting Analyst
or drop it. The instruction: "Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it." So we can include a
with Reports to, Location, Compensation Range. Also we need to include sections only when posting has real specific content. We have content for About the role (What We Do). Responsibilities (What You’ll Do). Requirements/Qualifications/Skills (What You Bring To The Team). Benefits (What We Offer). Pay: we have compensation range; we could include a Pay section? The instruction: "never create Pay/Schedule/Benefits sections unless the posting actually states them." It does state compensation range, so we can include a Pay section. However they said prefer a few substantive sections over many thin ones. Could combine Pay into a paragraph? But they said include a section ONLY when posting has real, specific content for it. It does have compensation range, so we could make a Pay section with that info. But they also said "Prefer a few substantive sections over many thin ones." Might be better to include Pay as a
within a generic "About the role" or separate? The instruction: Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So they expect we could use Pay heading if we have content. Since we have compensation range, we can include a Pay section. Similarly Benefits we have content, so Benefits section. Schedule? Not mentioned; we have remote work environment but not schedule specifics; we could omit Schedule. Thus sections: About the role (What We Do), Responsibilities (What You’ll Do), Requirements (What You Bring To The Team) maybe split into Requirements and Skills? Could combine. But we have qualifications and skills. Could make Requirements heading and list items. Or separate Qualifications and Skills. The instruction: "Prefer a few substantive sections over many thin ones." So maybe combine Requirements and Skills into one section titled Requirements (or Qualifications). But they gave examples of headings; we can choose. I'd do: About the role, Responsibilities, Requirements, Benefits, Pay. That's five sections. Now we need to extract content. About the role: The "What We Do" paragraph(s). Let's capture: "Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M+ endpoints and 15M+ identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other." That's the content. Responsibilities: The bullet list under "Responsibilities:" after "What You’ll Do:" Actually after "What You’ll Do:" there is a paragraph then "Responsibilities:" then list. We need to capture the list items exactly. List items: - Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on their performance. - Develop rules across a variety of Huntress products and operating systems, including Identity Threat Detection and Response (ITDR), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Windows, Linux, and macOS. - Manage any DE&TH requests raised internally or escalated from our partners. - Undertake hypothesis-driven hunts across Huntress telemetry, prioritizing techniques and tradecraft that may evade high-fidelity detections and initial SOC review. - Consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows. - Build and refine hunting dashboards or queries required to surface potential intrusions. - Review ambiguous signs of attacker activity across Huntress products, and surface likely intrusions that require deeper investigation. - Investigate or escalate likely intrusions identified to ensure partners receive clear incident reports with accurate advice. - Contribute findings to community-driven projects and create Huntress content such as blogs, social posts, videos, podcasts, and webinars. - Use AI-assisted workflows to prototype queries, enrich analysis, and develop a scaffolding for detection rules, ensuring you apply sound judgment to validate the AI output. - We expect everyone at Huntress to be able to use AI as a real part of how they work, not occasionally, but genuinely embedded in core workflows. Note: The last bullet is a sentence not starting with a dash? Actually it's part of the list? It appears as a separate sentence after the list but still part of responsibilities. We'll include as a list item. Now Requirements/Qualifications/Skills: Under "What You Bring To The Team:" then list. Items: - 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response. - Intermediate knowledge of Windows internals. - Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace. - Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations. - Ability to communicate findings through clear written reports. - Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL. - A sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system. - A sound understanding of the roles different threat actors play and their associated goals, such as initial access brokers, ransomware affiliates, and state-sponsored entities. - Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments. Bonus Points for: (these are optional but still content). Should we include them? They are substantive. Could include under same section or separate "Bonus Points". But we want few sections; maybe include them as part of Requirements but note they are bonus. We'll include them as list items under same section, maybe preceded by a note. But we must not invent filler. We'll include them as list items. Bonus points list: - Intermediate knowledge of Linux and MacOS internals. - Hands-on experience using tools to remotely discover evidence of compromise, such as OSquery, Velociraptor, and EDR/MDR/XDR platforms. - Previous use of forensic tooling such as Eric Zimmerman's EZ Tools, RegRipper, Hayabusa, or Chainsaw to analyze endpoint artifacts. - Intermediate malware analysis skills. Now Benefits: Under "What We Offer:" list. Items: - 100% remote work environment - since our founding in 2015 - Generous paid time off policy, including vacation, sick time, and paid holidays - 12 weeks of paid parental leave - Highly competitive and comprehensive medical, dental, and vision benefits plans - 401(k) with a 5% contribution regardless of employee contribution - Life and Disability insurance plans - Stock options for all full-time employees - One-time $500 reimbursement for building/upgrading home office - Annual allowance for education and professional development assistance - $75 USD/month digital reimbursement - Access to the BetterUp platform for coaching, personal, and professional growth Also there is a statement about inclusivity etc. That's boilerplate EEO; we should remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. So we should omit the inclusivity paragraph and the accommodation statement? The accommodation statement is also maybe considered boilerplate but it's specific to accommodations; but it's likely part of EEO. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. So we should remove the inclusivity paragraph and the accommodation paragraph. Also the AI usage statement maybe not boilerplate? It's about recruitment process; could be considered legal? Might be considered boilerplate but it's specific to AI usage. Safer to remove? The instruction says remove EEO/equal-opportunity/scam-warning boilerplate. The AI usage statement is not exactly EEO; but it's about recruitment process. Might be considered legal boilerplate. I'd remove it to be safe. Also remove the hashtag #BI-Remote at end. Now Pay section: Compensation Range: $150,000 to $170,000 base plus bonus and equity. We'll put that in a
or as a Pay section with
- . Since it's a single line, we can use
. Now we need to output only HTML fragment, no /, no markdown. Structure:
About the role
... (the paragraph)
Responsibilities
- ... ...
Requirements
- ... ...
Benefits
- ... ...
Pay
$150,000 to $170,000 base plus bonus and equity
Optionally include a short metadata paragraph for Reports to, Location. Could add abefore sections: "Reports to: Sr. Manager, Detection Engineering & Threat Hunting | Location: Remote US". That folds minor metadata. Let's do that. Now ensure we preserve all substantive information; we must not lose any details from the lists. Check each list item for completeness. Responsibilities list: ensure we captured all 11 items plus the AI expectation sentence. Let's count: 1 Contribute to all parts... 2 Develop rules across... 3 Manage any DE&TH requests... 4 Undertake hypothesis-driven hunts... 5 Consume threat intelligence... 6 Build and refine hunting dashboards... 7 Review ambiguous signs... 8 Investigate or escalate likely intrusions... 9 Contribute findings... 10 Use AI-assisted workflows... 11 We expect everyone at Huntress... Yes 11. Now Requirements list: we have 9 base items + 4 bonus = 13 items. Let's list them: Base: 1 2+ years of experience... 2 Intermediate knowledge of Windows internals. 3 Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace. 4 Experience developing, testing, tuning, and documenting detections... 5 Ability to communicate findings through clear written reports. 6 Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL. 7 A sound understanding of adversary tradecraft... 8 A sound understanding of the roles different threat actors play... 9 Ability to orchestrate