Head of Predictive Threat Detection Group

Lead Threat Hunting program at ecom.tech. Remote, 3-6 years experience, salary up to 600,000 ₽.

• Development of proactive threat detection and Threat Hunting program, including methodology, research prioritization, hunting backlog, and evaluation criteria. • Organizing proactive search for previously unidentified attacker activity using intelligence-driven, hypothesis-driven, TTP/behavior-based, IOC-driven, and data-driven approaches. • Prioritizing Threat Hunting directions based on current threat landscape, critical assets, business processes, Threat Intelligence data, investigation results, Red/Purple Team, and monitoring gaps. • Research and adaptation of attacker TTPs to company infrastructure using MITRE ATT&CK and other recognized industry models. • Managing IOC lifecycle: collection, enrichment, verification, relevance and reliability assessment, updating, contextualization, and application in hunting and detection processes. • Identifying gaps in telemetry and threat detection capabilities; defining requirements for event sources, monitoring tools, and Detection Engineering. • Converting Threat Hunting results into permanent defense mechanisms: detection scenarios, monitoring requirements, response scenarios, hardening recommendations, and follow-up research. • Preparing analytical and foresight reports on threat landscape: relevant attacker groups, campaigns, TTP changes, new attack vectors, likely threat evolution scenarios, and indicators. • Ensuring quality of analytical materials: assessing source reliability, documenting assumptions, limitations, confidence levels, and alternative scenarios. • Organizing group interaction with monitoring and response, Detection Engineering, DFIR, Threat Intelligence, Vulnerability Management, AppSec, Red/Purple Team, and information system owners. • Expert review of complex research and hunting cases, developing group knowledge base and methodology, developing employee competencies.

• Experience in Threat Hunting, Threat Intelligence, DFIR, Detection Engineering, or SOC, preferably at least 5 years, including technical leadership. • Deep knowledge of modern attack TTPs and MITRE ATT&CK Enterprise. • Knowledge of Threat Hunting methodologies: hypothesis-driven, intelligence-driven, TTP/behavior-based, IOC-driven, and data-driven approaches. • Understanding of Cyber Threat Intelligence processes, threat actor analysis, campaigns, attacker infrastructure, and IOC-TTP relationships. • Understanding of source reliability assessment, analytical confidence, uncertainty, and alternative hypotheses. • Deep understanding of corporate IT infrastructure architecture, Windows/Linux, network infrastructure, Identity/AD, cloud and SaaS services. • Practical understanding of SIEM, EDR/XDR, NDR, network monitoring systems, and security telemetry sources. • Experience building and analyzing search queries against large volumes of security events and conducting retrospective research. • Understanding of Detection Engineering principles and converting research results into sustainable detection mechanisms. • Knowledge of Cyber Threat Intelligence sharing principles and STIX/TAXII formats. • Practical data automation skills, preferably Python and/or PowerShell/Bash. • Skills in preparing technical, analytical, and management materials for various audiences. • Experience in organizing expert team work and interacting with technical and business units.