Principal Threat Hunting and Emulation Engineer - InfoSec

What Is The Role :

What You Will Be Doing :

• Lead structured, hypothesis-driven threat hunting operations across Elastic’s cloud, SaaS, endpoint, and CI/CD environments using frameworks such as PEAK, TaHiTI, or equivalent.
• Develop and maintain a threat hunting program at scale. Defining hunt hypotheses based on threat intelligence, ATT&CK mappings, and environmental risk profiles.
• Design and execute adversary emulation exercises and purple team engagements to validate detection pipelines, identify coverage gaps, and simulate real-world threat actor TTPs.
• Build and maintain a threat emulation library of reusable attack simulations, leveraging tools such as Atomic Red Team, Caldera, Scythe, or custom-developed tooling.
• Leverage AI and machine learning capabilities to accelerate hypothesis generation, anomaly detection, and the analysis of large, complex datasets during hunts.
• Translate hunt findings into production-ready detections, collaborating closely with Detection Engineering to ensure durable coverage.
• Document and codify hunt methodologies, playbooks, and emulation plans so that findings are repeatable, reviewable, and transferable.
• Partner with Threat Intelligence to inform hunt hypotheses based on emerging adversary campaigns, newly disclosed vulnerabilities, and sector-specific threat profiles.
• Identify visibility gaps exposed through hunting and emulation, and collaborate with Security Engineering to onboard the log sources needed to close them.
• Support incident response activities by applying hunting skills to accelerate investigation, scope incidents, and identify attacker dwell time or lateral movement.
• Contribute to the broader security community through blog posts, conference talks, open-source tooling, and other public knowledge sharing.

What You Bring :

• At least 8 years of experience in information security with a focus on threat hunting, detection engineering, incident response, or red/purple team operations with the Elastic Stack.
• Demonstrated experience in conducting structured and hypothesis-driven threat hunts in complex enterprise or cloud-native environments. The focus is on forward-thinking threat hunting, not just reactive investigation.
• Familiarity with threat hunting frameworks such as PEAK, TaHiTI, or Sqrrl, and the ability to apply them operationally and at scale.
• Experience designing and executing adversary emulation exercises or purple team engagements, including scoping, execution, and post-exercise reporting.
• Working knowledge of adversary TTPs through frameworks such as MITRE ATT&CK, and the ability to map real-world threat intelligence to hunt hypotheses.
• Experience using AI-assisted tooling or large language models to support threat hunting workflows, such as hypothesis generation, log summarization, or anomaly triage.
• Scripting or coding ability to automate repetitive hunt tasks or build custom tooling.
• A curious, research-driven mindset. You read threat reports, study malware, and seek to understand attacker behavior at a deep level.
• Strong written communication skills with an ability to document technical findings clearly for both technical and executive audiences.
• Is eligible to work in Department of Defense (DoD) Impact Level 4 or above cloud service environments.

Bonus Points :

• Background in both detection engineering and incident response—understanding how hunts feed detections and how incidents inform future hunts.
• Experience threat hunting in cloud environments (AWS, GCP, Azure).
• Familiarity with CI/CD and developer supply chain threat hunting (GitHub Actions, code pipeline integrity, dependency confusion, etc.).
• Contributions to open-source threat hunting or detection engineering projects, or public threat research publications.