Cyber Security Threat Hunter

Location: Centurion, Gauteng (provisional – to be confirmed)

Positions Available: 5

Salary: Market-related

Employment Type: To be confirmed

Job Overview We are seeking experienced and highly skilled Cyber Security Threat Hunters to proactively identify, investigate and analyse sophisticated cybersecurity threats across complex enterprise IT environments.

The successful candidates will be responsible for identifying malicious activities, advanced persistent threats, hidden compromises and suspicious behaviours that may not be detected by traditional automated security monitoring technologies.

This role requires strong hands-on expertise in proactive threat hunting, advanced security investigations, threat intelligence, endpoint and network telemetry analysis, and enterprise security monitoring technologies.

The ideal candidates will have proven experience developing threat-hunting hypotheses, analysing large volumes of security data, identifying attacker tactics, techniques and procedures (TTPs), and uncovering potential security compromises across endpoints, networks, identities and cloud environments.

Unlike a traditional SOC Analyst who primarily investigates alerts generated by security monitoring systems, a Cyber Security Threat Hunter proactively searches for threats that may have bypassed existing security controls or remain undetected within the organisation. Key Responsibilities

Proactive Cybersecurity Threat Hunting

• Conduct proactive threat-hunting activities across enterprise networks, endpoints, servers, applications and cloud environments.
• Identify suspicious behaviours, malicious activities and potential security compromises that have not triggered existing security alerts.
• Develop and execute structured threat-hunting hypotheses based on threat intelligence, attacker behaviour and environmental risk.
• Analyse endpoint, network, identity and cloud telemetry to identify indicators of compromise.
• Investigate potential advanced persistent threats, credential compromise, lateral movement and unauthorised access.
• Identify suspicious processes, persistence mechanisms and abnormal system behaviour.
• Conduct targeted investigations into high-risk systems, privileged accounts and critical infrastructure.
• Document threat-hunting methodologies, findings and investigation outcomes.
• Recommend improvements to security controls, monitoring and detection capabilities.
• Collaborate with SOC analysts, incident responders and detection engineers.

Advanced Threat Detection and Investigation

• Analyse security events and telemetry from SIEM, EDR, XDR and network monitoring platforms.
• Correlate security data from multiple sources to identify potential attacker activity.
• Investigate suspicious authentication patterns, privilege escalation and lateral movement.
• Analyse endpoint process activity, network connections, file modifications and system artefacts.
• Identify command-and-control communications and potential data exfiltration activities.
• Investigate suspicious PowerShell execution, scripting activity and other potentially malicious behaviours.
• Conduct advanced security investigations across Windows, Linux and cloud environments.
• Validate indicators of compromise and distinguish genuine threats from benign activity.
• Escalate confirmed or suspected security incidents to incident response teams.
• Maintain accurate investigation records and technical evidence.

Threat Intelligence and Adversary Analysis

• Analyse cyber threat intelligence to identify relevant threats targeting the organisation.
• Research attacker tactics, techniques and procedures.
• Apply the MITRE ATT&CK framework to threat-hunting investigations.
• Translate threat intelligence into actionable hunting hypotheses and investigation procedures.
• Monitor emerging threats, malware campaigns, exploitation techniques and adversary behaviours.
• Identify indicators of compromise associated with relevant threat actors.
• Conduct threat-informed investigations based on industry-specific risks.
• Support the development of threat profiles and attack scenarios.
• Collaborate with threat intelligence teams to improve threat detection and hunting coverage.

Endpoint and Network Threat Hunting

• Conduct advanced investigations using endpoint detection and response technologies.
• Analyse endpoint telemetry, processes, registry changes, scheduled tasks and persistence mechanisms.
• Investigate suspicious network traffic and abnormal communication patterns.
• Identify potential lateral movement and unauthorised internal network activity.
• Analyse DNS, proxy, firewall and network flow logs.
• Investigate suspicious remote access activity and unusual authentication events.
• Identify potential malware execution and attacker persistence.
• Support network-based threat detection and investigation.
• Recommend improvements to endpoint and network security monitoring.

Cloud and Identity Threat Hunting

• Conduct threat-hunting investigations across Microsoft Azure, AWS or equivalent cloud environments.
• Investigate suspicious cloud authentication and access activity.
• Analyse Microsoft Entra ID, Active Directory and privileged account security events.
• Identify potential identity compromise, token misuse and abnormal account behaviour.
• Investigate suspicious cloud workload activity and unauthorised configuration changes.
• Analyse cloud audit logs and security monitoring data.
• Identify potential privilege escalation and persistence within cloud environments.
• Support investigations involving Microsoft 365 and hybrid identity infrastructure.
• Recommend improvements to cloud security monitoring and identity protection controls.

Detection Engineering and Security Improvement

• Identify gaps in existing security monitoring and detection capabilities.
• Translate successful threat-hunting findings into new detection rules and security use cases.
• Develop or refine SIEM queries, correlation searches and threat detection logic.
• Support the validation of security detection rules and monitoring coverage.
• Collaborate with detection engineers to improve automated threat identification.
• Recommend additional log sources and telemetry collection requirements.
• Reduce false positives and improve security alert quality.
• Participate in Purple Team exercises and detection validation activities.
• Support continuous improvement of organisational threat detection capabilities.

Threat-Hunting Reporting and Documentation

• Develop structured threat-hunting plans, hypotheses and investigation procedures.
• Maintain detailed records of hunting activities and technical findings.
• Prepare threat-hunting reports and security investigation summaries.
• Document identified attack techniques, indicators of compromise and potential security weaknesses.
• Present findings to cybersecurity teams and relevant stakeholders.
• Recommend remediation measures and improvements to security controls.
• Track recurring threats and security monitoring gaps.
• Support security maturity assessments and continuous improvement initiatives.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Cybersecurity, Information Security, Digital Forensics or a related discipline.
• Typically 3–5 years of relevant hands-on experience in cybersecurity operations, threat hunting, advanced security investigations, incident response or a closely related technical specialisation.
• Proven practical experience conducting proactive threat-hunting investigations within enterprise environments.
• Strong understanding of attacker tactics, techniques and procedures.
• Practical experience developing and executing threat-hunting hypotheses.
• Strong hands-on experience with SIEM, EDR or XDR te