Senior Manager, Adversary Hunting
$205,000–$205,000 year
RemoteUnited States
Job Summary
Lead and mentor the Adversary Hunting team, guiding coverage of OT-focused Threat Groups and Temporary Activity Threads (TATs) while fostering analytical rigor. Serve as the primary point of contact for the team within Intelligence, aligning daily operations with WorldView reporting goals and optimizing workflows across Synapse and Storm Query Language pipelines. Partner with Vulnerability Research and Malware Analysis to translate hunting outcomes into prioritized intelligence, including IOCs and YARA rules, and deliver high-quality reports, Year in Review content, and executive briefings. Direct hunting support and triage during surge events and incident response engagements. Represent the team externally through webinars, industry events, and customer briefings. Requires 5-7 years in threat intelligence and OT adversary tracking, with up to 10% travel.
Required Qualifications
- At least 5-7 years of experience in threat intelligence, adversary tracking, threat hunting, or detection engineering
- At least 2 years mentoring or providing a level of leadership to personnel
- Demonstrated expertise tracking OT-focused Threat Groups and TATs
- Demonstrated expertise in hypothesis-driven hunting
- Demonstrated expertise in producing WorldView-style intelligence reporting
- Strong knowledge of attacker TTPs
- Strong knowledge of common frameworks used in threat hunting and adversary tracking (MITRE ATT&CK for ICS, the Diamond Model, ICS Cyber Kill Chain)
- Proficiency with Synapse
- Proficiency with Storm Query Language
- Proficiency in data modeling
- Proficiency in threat hunting
- Proficiency in investigative workflows
- Familiarity with network telemetry tools (e.g., NetFlow, Censys, Shodan)
- Familiarity with file-based analysis platforms (e.g., VirusTotal, Joe Sandbox)
- Excellent communication skills
- Ability to translate complex findings into WorldView reporting
- Ability to translate complex findings into YIR content
- Ability to translate complex findings into executive-level briefings
- Ability to represent technical work externally
- Ability to speak at webinars
- Ability to attend industry events
- Ability to conduct customer briefings
- Ability to engage with practitioners through social media
- Experience with industrial control systems security
- Experience with threat intelligence across critical infrastructure sectors
- Ability to travel up to 10%
- Must pass a background check
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.