Hiring guides/Cybersecurity/Threat Hunter
Cybersecurity threat detection talent · Hiring guide
The short answer
To hire a Threat Hunter, evaluate whether the candidate has proactively searched for adversary behavior that existing alerts did not already surface. Define the telemetry available, the threat model, the role of threat intelligence, the relationship with detection engineering and incident response, and how hunt findings will become durable security improvements—then evaluate candidates through hunts they have personally designed and executed.
Overture Partners helps employers identify and vet senior Threat Hunters for contract, contract-to-hire, and direct-hire needs.
Last updated October 13, 2026 · Reviewed quarterly for threat hunting, MITRE ATT&CK, EDR/XDR, SIEM, detection engineering, and incident-response relevance · 22 min read
Hiring guide
Threat Hunters are difficult to hire because effective hunting combines several disciplines:
The title also creates a screening problem.
Many candidates have performed:
Fewer have repeatedly designed proactive hunts for activity that existing detections might have missed.
MITRE ATT&CK is specifically designed around observed adversary behavior, including tactics, techniques, sub-techniques, and procedures, which makes it useful for hunt hypothesis development and detection coverage analysis.
Current Boston hiring reflects this distinction. Brown Brothers Harriman's Senior Threat Hunter role emphasizes proactive hunting across SIEM, EDR, identity, network, and cloud telemetry, while Bank of America's Boston Senior Threat Hunter role requires direct corporate threat-hunting experience, large-scale log analysis, threat intelligence, EDR/SIEM, and major-incident experience.
Use this guide to define the role, distinguish it from SOC monitoring and incident response, identify the right technical depth, structure interviews, plan compensation, choose an engagement model, and improve retention.
Chapter 01Role definition
A Threat Hunter proactively searches enterprise telemetry for evidence of malicious activity that may not have triggered existing alerts.
Hire for proactive, hypothesis-driven hunting, not alert triage under a new title.
The role may include:
Examples:
Potential data sources include:
Determine whether suspicious behavior is:
Successful hunts should create lasting value through:
SOC monitoring generally begins with:
A security control generated an alert.
Threat hunting begins with:
What adversary behavior might exist that our current alerts are not detecting?
Compare
Usually focuses on:
Usually focuses on:
CISA's endpoint guidance explicitly describes searching for hypothesized adversary behavior and correlating events across endpoints as a threat-hunting function.
A candidate who has only worked alerts generated by other people may be an excellent SOC analyst but not yet an experienced Threat Hunter.
Compare
Primarily asks:
Primarily asks:
The two disciplines overlap heavily.
A strong hunt may turn into an incident.
A strong incident may create several new hunt hypotheses.
Compare
Searches for:
Turns repeatable findings into:
A mature workflow looks like:
Hunt → discover behavior → validate → engineer detection → monitor
Threat hunting should not repeatedly rediscover the same activity because nobody converted the finding into detection logic.
Hire a Threat Hunter when the organization is asking questions such as:
If alert triage is already overwhelming the team, strengthening SOC operations may be the first priority.
If confirmed incidents are not being investigated effectively, Incident Response may be the more urgent hire.
Chapter 02Hunt method
A hypothesis defines a behavior or condition worth investigating.
Strong hunts start with a clear hypothesis and the right telemetry, mapped to real adversary behavior.
Example:
An attacker with stolen credentials may be using PowerShell remotely across a small number of privileged endpoints.
The hunter can translate that into:
Strong hypotheses may come from:
The goal is not searching randomly until something looks strange.
ATT&CK provides a shared language for adversary behavior.
MITRE defines:
Threat Hunters can use ATT&CK to:
ATT&CK should not become a checkbox exercise.
A team does not automatically become mature because it claims to cover many techniques.
The useful question is:
Can we actually observe and investigate the behaviors most relevant to our threat model?
ATT&CK changes as adversary behavior evolves.
MITRE's current Enterprise ATT&CK release is v19.2 as of August 2026. The 2026 updates include new and revised threat intelligence reflecting identity-token theft, cloud attacks, CI/CD and software-supply-chain activity, phishing, and emerging attacker tooling.
Senior hunters should not memorize ATT&CK IDs.
They should know how to:
Very.
EDR is often one of the richest hunt data sources.
Common platforms include:
Threat Hunters may investigate:
CISA guidance describes EDR-based searches for adversary behavioral indicators across process, network, executable, operating-system, and identity-related endpoint data as a direct threat-hunting capability.
Strong hunters should understand endpoint behavior beyond the product interface.
Relevant platforms may include:
Hunters should be comfortable:
Common query languages may include:
Brown Brothers Harriman's current Senior Threat Hunter role specifically identifies Splunk SPL and Microsoft KQL as valuable skills for hunting and detection work.
Potential behaviors include:
The hunter should avoid reducing investigations to:
Is this hash malicious?
Behavioral hunting is often more resilient than relying only on known indicators.
Modern attackers increasingly use valid credentials.
Hunters may investigate:
Identity-focused hunts can involve:
Recent ATT&CK updates continue to reflect the importance of credential theft and identity-token abuse in active threat campaigns.
Potential sources include:
Hunters may search for:
CISA continues to recommend investigating abnormal network activity such as scans, administrator-account manipulation, unusual PowerShell execution, and scripts not normally seen in the environment.
Hunters may need experience with:
Potential behaviors include:
Bank of America's current Boston Senior Threat Hunter role specifically identifies cloud hunting across Azure, Microsoft 365, and AWS as valuable experience.
Chapter 03Evaluation criteria
Senior hunters connect intelligence, malware behavior, and attacker tradecraft to the telemetry in front of them, and turn what they find into detections, records, and measurable improvements.
Look for hunters who turn findings into durable detections and can show how their work is measured.
Threat intelligence can provide:
The hunter's job is to translate intelligence into:
What should we search for in our environment?
Strong hunters understand the limitations of simple IOC searches.
Indicators can:
Behavioral TTPs can often provide more durable hunting value.
Useful skills may include:
Advanced reverse engineering is not mandatory for every role.
Require deep malware-analysis skills only when the environment genuinely needs them.
The hunter should, however, be able to use malware behavior to develop:
Attackers frequently use legitimate tools already present in enterprise environments.
Examples can include:
That can make malicious activity harder to distinguish from legitimate administration.
CISA specifically recommends behavior analytics, anomaly detection, and proactive hunting for living-off-the-land techniques because conventional indicator-based detection may miss them.
Senior hunters increasingly benefit from:
Bank of America's Boston Senior Threat Hunter role explicitly requests experience with large datasets and technologies including Python, Pandas, SQL, Splunk, Hadoop, and related analytics tooling.
The role is not data science.
But large-scale hunting increasingly rewards candidates who can move beyond manual console searches.
The team should determine whether the finding should create:
Current senior Threat Hunter roles explicitly connect hunting with detection improvement, SOC procedures, escalation playbooks, and analyst decision trees.
A threat-hunting program that repeatedly finds the same behavior without improving detection maturity is not creating enough durable value.
A hunt may uncover evidence that justifies:
Threat Hunters should understand:
Current Boston Senior Threat Hunter positions commonly expect prior Incident Response or major-investigation experience because hunters may identify threats before established response processes have been activated.
Useful fields include:
The objective is making hunts:
rather than leaving knowledge in one analyst's notebook.
Avoid simplistic metrics such as:
Potential measures include:
The purpose is not maximizing hunt volume.
It is increasing the organization's ability to discover adversary activity.
| Skill area | What to look for | Why it matters |
|---|---|---|
| Threat hunting | Hypothesis-driven proactive investigations | Core responsibility |
| EDR / XDR | Endpoint behavioral analysis and querying | Rich source of adversary telemetry |
| SIEM | Cross-source queries, pivots, timelines | Hunting requires large-scale data analysis |
| MITRE ATT&CK | TTP-based hunt design and coverage analysis | Provides adversary-behavior structure |
| Detection engineering | Converting hunts into detections | Creates durable defensive value |
| Incident response | Escalation, scoping, containment judgment | Hunts can uncover active compromise |
| Threat intelligence | Translating intelligence into hunt hypotheses | Helps prioritize relevant adversary behavior |
| Malware analysis | Behavioral understanding | Supports deeper investigation |
| Identity / cloud | Modern authentication and cloud telemetry | Increasingly important attack surfaces |
| Scripting / analytics | Python, SQL, SPL, KQL | Helps hunt at enterprise scale |
| Communication | Clear technical findings and risk explanation | Hunts need actionable outcomes |
Chapter 04Talent sourcing
Strong Threat Hunters rarely start with the title. They come from SOC, incident response, detection engineering, threat intelligence, and offensive security backgrounds.
Source across SOC, IR, detection engineering, and intelligence teams for people who have designed hunts, not just worked alerts.
Relevant backgrounds include:
| Background | Strength | Gap to evaluate |
|---|---|---|
| Senior SOC Analyst | SIEM, investigations | Proactive hunt methodology |
| Incident Responder | Scoping and attacker investigation | Hypothesis-driven proactive work |
| Detection Engineer | Analytics and coverage | Open-ended investigation |
| DFIR Specialist | Evidence and timeline reconstruction | Enterprise-scale hunting |
| Threat Intelligence Analyst | Adversary knowledge | Hands-on telemetry analysis |
| Red Teamer | Attacker tradecraft | Defensive telemetry and operational processes |
The strongest candidates often combine several of these backgrounds.
Threat Hunter searches create a particularly high risk of title inflation.
Candidates may describe routine alert investigation as threat hunting.
Overture Partners helps employers test for evidence of:
The goal is to distinguish genuine proactive hunting from reactive SOC monitoring.
Chapter 05Candidate evaluation
Use adversary-behavior scenarios rather than product trivia.
Ask candidates to walk through hunts they designed themselves, including the ones that found nothing.
Document:
Ask:
Walk us through a hunt you designed before there was an alert.
Clarify:
Present:
Intelligence reports that an attacker targeting your industry is abusing remote PowerShell and valid administrator credentials.
Ask how the candidate would hunt.
Look for:
Ask:
You find unusual PowerShell on one endpoint. What do you pivot to?
Look for:
Present:
A privileged user has valid MFA but begins authenticating to resources they have never accessed.
Look for:
Ask:
Your hunt identifies a repeatable malicious behavior.
Strong candidates should discuss:
Ask:
At what point does a hunt become an incident?
Look for:
Ask:
Tell us about a hunt where you found nothing.
Strong candidates should still explain:
A hunt is not automatically unsuccessful because it did not uncover an attacker.
25 questions
Chapter 06Time, cost, and engagement
Proactive hunting experience is scarce, so plan for a narrower pool, a focused interview loop, and pay that reflects detection and response depth.
Budget for scarce detection and response depth, move quickly, and match the engagement model to the work.
Difficulty score: 8.6 / 10 — Very Difficult
Effective threat hunters combine:
Proven proactive-hunting experience is less common than general SOC monitoring experience.
Current Boston hiring reflects that scarcity. Brown Brothers Harriman requires at least five years across Security Operations, Incident Response, Threat Hunting, Detection Engineering, or related roles and expects proactive hunting across enterprise telemetry. Bank of America's Senior Threat Hunter position requires eight-plus years in adjacent technical security disciplines plus direct experience performing threat hunting in an active corporate environment.
There is no sufficiently reliable market-wide time-to-fill benchmark specific to senior Threat Hunters.
For planning:
Deep requirements involving:
can narrow the pool further.
Strong candidates may qualify simultaneously for:
These are Overture planning recommendations rather than published market-wide hiring statistics.
A weak fit can create the appearance of proactive defense without meaningful improvement.
Potential outcomes include:
The role creates the most value when hunting uncovers:
and turns those discoveries into durable defensive improvements.
Threat Hunter salary data is less standardized than broader SOC or cybersecurity analyst data, so current comparable openings are especially useful.
The difference reflects factors such as:
Boston employers compete for senior Threat Hunters across:
Current local openings demonstrate both specialization and compensation pressure.
Brown Brothers Harriman's Boston Senior Threat Hunter role pays $110K–$160K and combines proactive telemetry hunting, investigations, detection improvement, incident-response support, and CTI.
Bank of America's Boston Senior Threat Hunter role pays $145K–$192.5K and requires eight-plus years of adjacent security experience, large-scale analytics, direct corporate threat-hunting experience, CTI, EDR/SIEM, and major-incident experience.
For senior hiring, employers should benchmark against the actual hunt mandate rather than generic SOC analyst compensation.
Published contract benchmarks for dedicated Threat Hunters are inconsistent, so rates should be calibrated to senior SOC, DFIR, detection-engineering, and threat-hunting depth.
Practical hourly planning range
These are Overture planning recommendations, not universal market statistics.
Specialized engagements involving active threat campaigns, complex cloud environments, or advanced threat intelligence may price higher.
| Model | Best use case | Advantage | Tradeoff |
|---|---|---|---|
| Contract | Hunt backlog, detection maturity initiative, targeted adversary assessment | Rapid senior capacity | Limited institutional continuity |
| Contract-to-hire | Building a new hunting capability | Allows real-world evaluation | Requires clear conversion path |
| Direct hire | Long-term threat-hunting and detection program | Strong environment knowledge | More deliberate search |
| Consulting engagement | Specific campaign, assessment, or hunt program design | Specialist expertise | Not continuous internal hunting |
Chapter 07Industry and retention
Industry changes the adversaries, telemetry, and regulatory pressure a hunter works against, and retention depends on giving hunters time, data, and influence.
Match the hunter to your industry's threats and telemetry, and give them the time and authority to improve detections.
Prioritize:
Current Boston banking roles place particular weight on enterprise-scale telemetry, financial-services threat intelligence, detection strategy, and advanced investigations.
Look for:
Relevant areas include:
Prioritize:
Potential requirements include:
Strong hunters need access to useful telemetry and freedom to investigate meaningful hypotheses.
Common models include:
Threat Hunters serve as senior proactive defenders within Security Operations.
Threat Hunting, Detection Engineering, and Incident Response operate as one integrated function.
Hunting works closely with CTI to operationalize intelligence.
Large organizations may maintain a separate hunting capability.
Regardless of structure, the team should have direct working relationships with:
Compare
Focuses on:
Focuses on:
The Threat Hunter goes deeper technically.
The SOC Lead owns the broader operating model.
The PRECISE Talent Blueprint
Seven steps that look past ATT&CK and tool keywords to the hunts a candidate actually designed, ran, and turned into detections.
We begin with the actual detection environment.
That includes EDR/XDR, SIEM, identity, cloud, network telemetry, threat intelligence, detection maturity, incident response, and adversary priorities.
Threat-hunting experience is easy to overstate.
We look beyond the title to understand which hunts candidates personally designed, what hypotheses they tested, which telemetry they used, and how their findings improved security.
Threat Hunters depend on collaboration with SOC analysts, detection engineers, incident responders, threat intelligence, security engineering, and cloud teams.
We remain engaged so telemetry or ownership gaps can surface early.
Strong hunters need curiosity without becoming unfocused.
We assess analytical discipline, communication, collaboration, documentation, and the ability to challenge assumptions while remaining evidence-driven.
Every organization has different telemetry, architecture, adversary exposure, detection maturity, and business context.
Clear onboarding helps hunters understand those differences before interpreting anomalies.
We evaluate candidates against the actual requirements, including threat hunting, EDR/XDR, SIEM, detection engineering, MITRE ATT&CK, malware analysis, incident response, cloud, and identity.
The goal is not simply to hire someone who can search logs.
It is to identify a Threat Hunter who can uncover meaningful gaps, identify hidden adversary activity, and make the organization's defensive capabilities stronger after every hunt.
Why Overture Partners
Overture Partners has provided IT staffing and technology recruiting support since 2001.
Threat Hunter searches require more than matching MITRE ATT&CK, Splunk, or CrowdStrike keywords.
We then evaluate candidates for evidence of real proactive hunting, adversary reasoning, enterprise telemetry analysis, detection improvement, and incident judgment.
The goal is to identify Threat Hunters who can find what existing alerts may have missed—and make the organization harder to surprise the next time.
What we clarify at intake
We help employers clarify:
Frequently asked questions
Quick answers to the questions hiring managers ask most. The full detail is in the chapters above.
Ask a talent specialistProven proactive-hunting experience is less common than general SOC monitoring experience. Senior hunters need to combine adversary tradecraft, SIEM, EDR/XDR, ATT&CK, detection engineering, incident-response judgment, and increasingly cloud and identity telemetry.
A Threat Hunter proactively searches enterprise telemetry for signs of adversary activity that may not have triggered existing detections. The role often includes hypothesis development, EDR/SIEM analysis, ATT&CK mapping, investigation, detection improvement, and incident escalation.
SOC monitoring usually reacts to generated alerts. Threat hunting proactively searches for suspicious behavior that existing detections may have missed.
Threat Hunters proactively search for hidden adversary activity. Incident Response Specialists investigate and contain confirmed or strongly suspected security incidents.
Common requirements include threat hunting, EDR/XDR, SIEM, MITRE ATT&CK, detection engineering, threat intelligence, malware analysis, incident response, identity, cloud, and scripting or data-analysis skills.
ATT&CK provides a behavioral taxonomy of adversary tactics, techniques, sub-techniques, and procedures. Hunters can use it to create hypotheses, map attacker behavior, identify telemetry requirements, and evaluate detection gaps.
Working malware-analysis knowledge is valuable because behavior observed in malware can generate hunt hypotheses and detections. Deep reverse-engineering expertise is only necessary for roles with a specialized malware component.
Increasingly, yes. Enterprise adversaries frequently operate across cloud control planes, SaaS identities, tokens, and traditional endpoints. Current senior Boston threat-hunting roles explicitly value Azure, Microsoft 365, and AWS hunting experience.
Investigate candidates who describe normal alert triage as hunting, cannot provide a self-generated hunt hypothesis, rely only on IOC searches, have weak EDR/SIEM query depth, or cannot explain how hunt findings improved detections.
Ask them to walk through a hunt that began before an alert existed. Have them explain the hypothesis, telemetry, queries, pivots, findings, escalation, and how the results changed detection or security controls.
Current Boston Senior Threat Hunter openings range from $110K–$160K at Brown Brothers Harriman to $145K–$192.5K at Bank of America. For planning, Overture recommends approximately $145K–$190K for senior Threat Hunters, adjusted for scope and market.
For planning, senior Threat Hunters may fall around $105–$145 per hour, while advanced specialists may reach approximately $135–$185 per hour or more. These are Overture planning bands rather than universal published rates.
Contract hiring works well for targeted hunting programs, detection-maturity projects, hunt backlogs, and short-term specialist capacity. Direct hiring is preferable when the organization wants continuous environment-specific threat hunting and long-term detection improvement.
Protect dedicated proactive-hunting time, invest in telemetry and analytics, connect hunts to threat intelligence and detection engineering, support DFIR and malware training, and provide senior technical career paths.
A specialized staffing partner can help when internal recruiting struggles to distinguish reactive SOC investigation from genuine proactive hunting or when the role requires a specific combination of EDR, SIEM, ATT&CK, incident response, and detection engineering.
Find threats before alerts find them
Tell us which telemetry and security platforms your organization uses, which adversaries or attack patterns matter most, and where proactive hunting, detection gaps, cloud/identity analysis, or advanced investigation needs stronger support.
An Overture talent specialist can help clarify the Threat Hunter profile, identify the capabilities that matter most, and determine whether contract, contract-to-hire, or direct hiring is the most practical path.
We typically respond within one business day.