Avanade
Threat Hunting & Intelligence Lead
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Threat Hunting & Intelligence Lead
As the Threat Hunting & Intelligence Lead, you will be a senior security specialist responsible for designing, establishing, and leading an intelligence-led threat hunting capability across the managed security service. This role combines hands-on technical excellence, analyst development, and client-facing leadership to deliver proactive security outcomes beyond traditional SOC alerting.
You will reshape the threat hunting programme from the ground up, defining AI-enabled methodologies, telemetry requirements, and measures of success before evolving into ongoing hunting execution, coaching analysts, and acting as a trusted advisor to clients and internal stakeholders. The role blends offensive attacker-mindset insight with deep defensive detection and response expertise, making it a key differentiator for both service delivery and pre-sales engagements.
Key Responsibilities
Threat Hunting Programme Development
- Design and establish a formal, repeatable threat hunting programme, including:
- Hunting methodologies and frameworks
- Hypothesis-driven hunting models
- Tooling, data sources, and telemetry requirements
- Clear success metrics and measurable outcomes
- Define and embed how threat hunting integrates with:
- SIEM detections and detection engineering
- SOC operations and workflows
- Incident response processes
- Intelligence-led prioritisation and use-case development
- Ensure hunting outputs directly inform continuous service improvement.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Hands-On Threat Hunting & Intelligence
- Conduct advanced, hands-on threat hunts in the Microsoft Ecosystem Primarily across:
- Endpoint (EDR/XDR)
- Identity and authentication telemetry
- Cloud platforms and SaaS environments
- SIEM and log-based data sources
- Apply offensive security tradecraft (attacker TTPs, kill chains, evasion techniques) to uncover threats that bypass automated detections.
- Translate hunting and intelligence outcomes into:
- New or improved detection cases
- Automation opportunities
- SOC operational enhancements
- Detection coverage and fidelity improvements
- Maintain strong awareness of the current threat landscape, adversary behaviours, and emerging attack techniques.
Analyst Coaching & Capability Uplift
- Coach and mentor SOC analysts through collaborative hunting, developing:
- Threat-led and adversary-focused thinking
- Strong investigative depth and analytical reasoning
- Confidence in hypothesis-driven analysis
- Lead hunts in a collaborative model, uplifting analyst capability rather than operating as a siloed expert.
- Embed a continuous learning culture where hunting outcomes directly improve detections, response playbooks, and analyst maturity.
- Act as a client-facing authority for threat hunting and threat intelligence, able to:
- Explain hunting outcomes in clear, business-relevant language
- Demonstrate how proactive hunting reduces risk beyond reactive alerting
- Articulate the value of intelligence-led security operations
- Serve as a trusted advisor during service reviews, executive briefings, and strategic engagements.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Technical Leadership & Collaboration
- Demonstrate deep technical expertise across:
- SIEM platforms
- EDR/XDR technologies
- Cloud security platforms
- Identity and access telemetry
- Work closely with:
- Detection Engineering teams
- Platform Automation and Engineering
- SOC leadership and incident response leads
- Ensure threat hunting insights drive tangible, measurable service improvements.
Qualifications
Core Experience & Skills
- Extensive experience in threat hunting, detection engineering, or advanced SOC operations.
- Strong understanding of adversary behaviors, attack chains, and modern threat actor tradecraft.
- Deep hands-on experience with SIEM, EDR/XDR, cloud, and identity telemetry.
- Proven ability to design and operate hypothesis-driven hunting programmes.
- Experience translating technical findings into business-level risk and outcomes.
- Strong collaboration and leadership skills within multi-disciplinary security teams.
- Confident communicator
- MSSP Background a Positive.
- Relevant certifications such as (or equivalent to):
- CEH
- Offensive security or red team certifications
- Advanced detection or threat hunting credentials
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location