Staff Threat Hunting & Intelligence Engineer

Application window closes on 10/26/2026. The posting may be removed earlier if the position is filled or a sufficient number of applications are received.

Team and Reporting

This role reports to the Senior Manager, Threat Hunting and Intelligence (THI) in the Global Security Operations organization. As a member of THI, you will collaborate with multi‑functional peer teams including Detection Engineering, SOC, Advanced Response, and others.

Impact

The position combines threat intelligence, threat hunting, and engineering. You will track sophisticated adversaries, deliver timely intelligence to support incident response, hunt for adversary activity across large datasets, and build automation that turns intelligence and hunt findings into repeatable, scalable capabilities. The role participates in an on‑call rotation and may require after‑hours support during major incidents.

Responsibilities

• Deliver actionable threat intelligence during active incidents, including indicators, TTPs, behavioral patterns, and threat actor context.
• Produce cadenced and ad‑hoc intelligence products that inform hunts, detections, and business decisions.
• Plan and conduct threat hunts (retrospective, project‑based, and ad‑hoc) and maintain a hunt library for daily team use.
• Build and maintain scripts, API integrations, and automation that scale THI’s intelligence and hunting use cases, improving threat‑data ingestion, processing, and enrichment while reducing cycle time.
• Apply AI to accelerate intelligence analysis, hunting, and tooling development.
• Uncover adversary activity missed by current detection rules and hand findings to Detection Engineering to close gaps.
• Craft compelling written products, presentations, and RFI responses for technical and non‑technical audiences.
• Mentor analysts and engineers across threat intelligence, hunting, and engineering.

Minimum Qualifications

• 8+ years of professional cybersecurity experience with demonstrable time in cyber threat intelligence and/or threat hunting.
• Experience with sophisticated searching and reporting in Splunk, and the ability to build and interpret SPL fluidly.
• Ability to translate large datasets into meaningful information and persist in hunts without easy wins.
• Understanding of attacker behavior and the ability to translate intelligence and hunt findings into repeatable, automated capabilities.
• Experience applying AI to accelerate development and analysis.

Preferred Qualifications

• Experience leading threat actor and campaign attribution.
• Strong programming proficiency in one or more languages for scripts and API automation of threat‑data ingestion and processing.
• Experience delivering tactical threat intelligence in support of incident response.
• Hands‑on experience with DevOps, infrastructure‑as‑code, and CI/CD tooling.
• Willingness to participate in an on‑call rotation, including after‑hours support during major incidents.
• Expertise in uncovering adversary activity missed by industry detection rules.
• Experience with network and host‑based logs and a solid understanding of common services (DNS, DHCP, email, proxy, VPN, firewall, etc.).
• Proficiency in cloud technologies (AWS, GCP, or Azure) and a robust understanding of Linux.

Why Cisco?

Cisco is revolutionizing how data and infrastructure connect and protect organizations in the AI era and beyond. With 40 years of innovation, Cisco delivers unparalleled security, visibility, and insights across the entire digital footprint. The company emphasizes teamwork, empathy, and global impact, offering limitless opportunities to grow and build.

Pay

Starting salary range: $160,700 – $203,500 (U.S. and/or Canada locations). Specific ranges vary by location, e.g., New York City Metro Area $180,300 – $263,000; Non‑Metro New York State & Washington State $160,700 – $234,100.

Benefits

• Medical, dental, and vision insurance.
• 401(k) plan with Cisco matching contribution.
• Paid parental leave.
• Short‑ and long‑term disability coverage.
• Basic life insurance.
• Eligibility for Cisco restricted stock unit grants.
• 10 paid holidays per year plus 1 floating holiday (non‑exempt).
• 1 paid day off for employee’s birthday and paid year‑end holiday shutdown.
• 4 paid personal wellness days.
• Non‑exempt: 16 days of paid vacation per year (accrued at 4.92 hours per pay period).
• Exempt: Flexible vacation time off program (no defined limit).
• 80 hours of sick time on hire and each January 1, with carry‑forward of up to 80 hours.
• Optional 10 paid volunteer days per year.
• Eligibility for annual bonuses (non‑sales roles).

Schedule

The role includes participation in an on‑call rotation and may require after‑hours support during major incidents.