Threat Hunter Investigator

Piper Companies is seeking a Threat Hunting Investigator for a leading technology organization. The Threat Hunting Investigator is a Remote position operating on EST business hours. An ideal candidate for the Threat Hunting Investigator is a seasoned cybersecurity professional with expertise in insider threat investigations, advanced Splunk detection engineering, and hands-on experience developing SPL queries, Risk-Based Alerting (RBA), and User and Entity Behavior Analytics (UEBA) solutions.

Responsibilities of the Threat Hunting Investigator:

• Conduct proactive threat hunting and investigations focused on insider threats, suspicious user behavior, and protection of critical intellectual property.
• Design, develop, test, deploy, and tune advanced Splunk detections, correlation searches, risk rules, and RBA workflows using SPL.
• Configure and optimize UEBA detections and behavioral analytics to identify high-risk activity across enterprise environments.
• Produce detailed investigative reports, technical documentation, and actionable recommendations to support security operations and risk mitigation.

Qualifications of the Threat Hunting Investigator:

• 8+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations.
• Advanced hands-on experience with Splunk Enterprise Security, including writing complex SPL queries from scratch and developing production-ready detections.
• Strong experience with Risk-Based Alerting (RBA), User and Entity Behavior Analytics (UEBA), and security detection engineering methodologies.
• Proven ability to translate threat intelligence and MITRE ATT&CK techniques into operational detections, response workflows, and measurable security outcomes.

Compensation for the Threat Hunting Investigator includes:

• Comprehensive benefits package including medical, dental, vision, 401(k), sick leave as required by law, and PTO.

This job opens for applications on 10/16/2026. Applications for this job will be accepted for at least 30 days from the posting date.

#LI-MM9

#LI-REMOTE