[All remote jobs](https://jobicy.com/jobs.md)[![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg)](https://jobicy.com/company/huntress.md)[Huntress](https://jobicy.com/company/huntress.md) # Senior Detection Engineering & Threat Hunting Analyst Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/huntress.md)ShareRemote from[Australia](https://jobicy.com/job-region/australia.md)SalaryAUD 150k–170k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished21 Oct 2026Apply before20 Nov 2026Listing views40Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Huntress is seeking a senior cybersecurity analyst to build, test, tune, and maintain detections while conducting proactive threat hunts across endpoint, identity, and SIEM telemetry. The role supports a 24/7 SOC by translating threat intelligence, IOCs, hypotheses, and investigation findings into high-fidelity detections and actionable incident escalations. It requires practical knowledge of Windows internals, cloud and productivity environments, adversary tradecraft, and detection and query languages such as Sigma, YARA, KQL, and Splunk SPL. The analyst will work at scale across millions of endpoints, collaborate with engineering and security teams, and use validated AI-assisted workflows in production-oriented detection development. This is a fully remote role restricted to Australia. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThe position combines detection engineering, hypothesis-driven hunting, and intrusion investigation across large-scale telemetry, requiring strong technical judgment and knowledge of evolving attacker techniques. High stakes, false-positive management, and close alignment with a 24/7 SOC make the work technically demanding and fast moving. ## Salary analysis Estimated compensation compared with the broader AU market for similar roles. Estimated job median (per year)Market rateA$160,000AU market range (per year)A$145k–A$190k0A$209.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer explicitly lists a base compensation range of AUD 150,000–170,000 plus bonus and equity. The annual period is inferred from the senior full-time Australian cybersecurity role and the stated compensation magnitude; estimated market pay is AUD 145,000–190,000 per year. ## Core skills Skills and capabilities most closely associated with this opportunity. [Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Threat hunting](https://jobicy.com/jobs?search_keywords=Threat%20hunting.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Windows internals](https://jobicy.com/jobs?search_keywords=Windows%20internals.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[EDR](https://jobicy.com/jobs?search_keywords=EDR.md)[Sigma](https://jobicy.com/jobs?search_keywords=Sigma.md)[YARA](https://jobicy.com/jobs?search_keywords=YARA.md)[KQL](https://jobicy.com/jobs?search_keywords=KQL.md)[Splunk SPL](https://jobicy.com/jobs?search_keywords=Splunk%20SPL.md)[Threat intelligence](https://jobicy.com/jobs?search_keywords=Threat%20intelligence.md)[MITRE ATT&CK](https://jobicy.com/jobs?search_keywords=MITRE%20ATTCK.md)[Linux](https://jobicy.com/jobs?search_keywords=Linux.md)[macOS](https://jobicy.com/jobs?search_keywords=macOS.md)[Microsoft Azure](https://jobicy.com/jobs?search_keywords=Microsoft%20Azure.md) Sample interview questionsHow do you take a threat-intelligence report from initial research to a production detection?I first identify the relevant TTPs, telemetry sources, and expected attacker behaviors rather than relying only on IOCs. I build a query or rule, validate it against known benign activity and test data, document assumptions and response guidance, then deploy it with monitoring for fidelity and coverage. I use feedback from alerts and investigations to tune, promote, or retire the detection. Describe how you would conduct a hypothesis-driven hunt for credential theft on Windows endpoints. I would define a focused hypothesis, such as an attacker attempting LSASS access or dumping credentials through suspicious tooling. I would query process, module, command-line, handle-access, and authentication telemetry; then correlate results with user context, endpoint history, and known administrative activity. Findings would be triaged for legitimate explanations, escalated when evidence supports intrusion, and used to improve durable detections. How do you balance false positives and false negatives in a high-volume detection environment? I prioritize detections based on adversary impact, telemetry reliability, and the cost of analyst investigation. For noisy rules, I seek contextual enrichment and narrow exclusions that are documented and periodically reviewed rather than broadly suppressing alerts. I also monitor missed detections through incident retrospectives, threat hunts, and coverage reviews to ensure tuning does not create blind spots. What is your approach to validating AI-generated detection queries or rules? I treat AI output as a draft, not an authoritative result. I verify syntax, data-model assumptions, logic, performance, and mapping to the intended adversary behavior, then test it against representative benign and malicious cases. Before production deployment, I ensure the rule has clear rationale, triage guidance, ownership, and measurable efficacy criteria. How would you communicate a likely intrusion discovered during a hunt to the SOC and a customer-facing team? I would provide a concise evidence-led report covering the affected assets and identities, timeline, observed behaviors, confidence level, relevant MITRE techniques, and recommended containment or investigation actions. I would clearly distinguish confirmed facts from hypotheses and include the supporting telemetry needed for repeatable validation. For customer-facing communication, I would avoid unnecessary jargon while preserving technical accuracy and urgency. Opportunity details ## About this role. What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers’ protection. Huntress now secures more than 5M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Senior Manager, Detection Engineering & Threat Hunting Location: Remote Australia Compensation Range: $150,000 to $170,000 AUD base plus bonus and equity What You’ll Do: Members of the Huntress DE&TH team wake up every morning with the honor of impeding threat actors through a combination of detection engineering and threat hunting. This team sits alongside our 24×7 Security Operations Center, and our Adversary Tactics & Tactical Response function, and plays a pivotal role in detecting threats actors before they get a chance to impact our partner environments. As a Senior Detection Engineering and Threat Hunting (DE&TH) Analyst you should be drawn to the hard problems: detecting stealthy intrusions, managing false positives and false negatives at scale, and uncovering clues that may expose an evolving campaign across Huntress partners. In this role you will turn threat intelligence, or a hypothesis, into detections that help the SOC find real intrusions faster. While the SOC is responding to alerts within minutes, this team is developing detections and reviewing more ambiguous signs of attacker activity on a daily & weekly basis. On the Detection Engineering side of the role, you will play a part in designing, building, and maintaining a resilient, scalable, and high-fidelity detection portfolio that enables the SOC to rapidly identify and respond to adversary activity. This will involve working with engineering and other adjacent teams to achieve a shared goal across multiple domains which includes identities and endpoints. On the Threat Hunting side of the role, you will get to research new attacker tradecraft, test new theories, and review hunting data at scale for millions of endpoints to proactively hunt for, and disrupt, stealthy threat actor techniques that evade initial defenses. If you love Detection Engineering and Threat Hunting at scale, whilst in the environment and energy of a SOC, this is the role for you! Responsibilities: * Contribute to all parts of the detection lifecycle by creating new rules, testing them before deployment, monitoring efficacy, and tuning, promoting, or retiring rules based on their performance. * Develop rules across a variety of Huntress products and operating systems such as: Identity Threat Detection and Response (ITDR), Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR), Windows, Linux, and MacOS. * Manage any DE&TH requests raised internally or escalated from our partners. * Undertake hypothesis-driven hunts across Huntress telemetry, prioritising techniques and tradecraft that may evade high-fidelity detections and initial SOC review. * Consume threat intelligence and translate IOCs, TTPs, and internal findings into new or refined detections through Git-based workflows. * Build and refine hunting dashboards or queries required to surface potential intrusions. * Review ambiguous signs of attacker activity across Huntress products, and surface likely intrusions that require deeper investigation. * Investigate or escalate likely intrusions identified to ensure partners receive clear incident reports with accurate advice. * Contribute findings to community-driven projects and create Huntress content such as blogs, social posts, videos, podcasts, and webinars. * Use AI-assisted workflows to prototype queries, enrich analysis, and develop a scaffolding for detection rules, ensuring you apply sound judgment to validate the AI output. We expect everyone at Huntress to be able to use AI as a real part of how they work, not occasionally, but genuinely embedded in core workflows. What You Bring To The Team: * 2+ years of experience in detection engineering, threat hunting, SOC, MDR, or incident response. * Intermediate knowledge of Windows internals. * Working knowledge of Linux, macOS, Microsoft 365, Azure, and Google Workspace. * Experience developing, testing, tuning, and documenting detections or analytics from threat intelligence, IOCs, hypotheses, or real-world investigations. * Ability to communicate findings through clear written reports. * Strong familiarity with detection languages such as Sigma, Suricata, Snort, or YARA, and query languages such as KQL, EQL, ES|QL, or Splunk SPL. * A sound understanding of adversary tradecraft, including techniques used for persistence, privilege escalation, defense impairment, lateral movement, discovery, and collection on a system. * A sound understanding of the roles different threat actors play and their associated goals, such as: initial access brokers, ransomware affiliates, and state-sponsored entities. * Ability to orchestrate reusable AI workflows that improve threat hunting, detection development, or analysis, and can verify AI-generated outputs before they reach production environments. Bonus points for: * Intermediate knowledge of Linux and MacOS internals. * Hands-on experience using tools to remotely discover evidence of compromise such as OSquery, Velociraptor, and EDR/MDR/XDR platforms. * Previous use of forensic tooling such as Eric Zimmerman’s EZ Tools, RegRipper, Hayabusa, or Chainsaw to analyze endpoint artifacts. * Intermediate malware analysis skills. What We Offer: * Fully remote work * At least one annual trip to the US for Summer Summit, with additional local events in Australia! * New starter home office set up reimbursement ($800 AUD) * 12 weeks paid parental leave for both primary and secondary carers * Monthly digital allowance for personal phone and internet costs ($185 AUD) * Monthly home office tech stipend to upgrade or replace equipment ($40 AUD) * Subsidised private health insurance through our preferred provider * Stock options for all full-time employees * Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [accommodations@huntresslabs.com](mailto:accommodations@huntresslabs.com). Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our [Candidate Privacy Notice](https://trust.huntress.com/?itemUid=47f0a941-b86f-4864-a0d0-a224a34cfd57&source=click) for more details on our practices and your data privacy rights. #BI-Remote Show more [Apply now >](https://jobicy.com/jobs/156136-senior-detection-engineering-threat-hunting-analyst.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Oct 21 New ### [Senior All-Source Investigator, Severe Harms](https://jobicy.com/jobs/156139-senior-all-source-investigator-severe-harms.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 21 New ### [Security Operations Analyst](https://jobicy.com/jobs/156132-security-operations-analyst.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![AlphaSense logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01960e94-221.jpg) AlphaSense Oct 21 New ### [Senior Product Security Engineer](https://jobicy.com/jobs/156123-senior-product-security-engineer.md) About AlphaSense: AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The… * ![SkySlope logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/1e0d9f0517a4959cdef118a420f873a6.jpeg) SkySlope Oct 21 New ### [Security Engineering Manager](https://jobicy.com/jobs/153718-security-engineering-manager.md) OUR ORIGIN STORY 🎂 In 2011 SkySlope started as an idea born at the kitchen table of our CEO, with just him and two others. Headquartered in Sacramento, California, we… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 21 New ### [Senior Technical Program Manager – Security](https://jobicy.com/jobs/151221-senior-technical-program-manager-security.md) About the Team OpenAI builds powerful AI systems like ChatGPT, the OpenAI API, and enterprise products that serve millions of users across the globe. As we scale, securing our infrastructure,… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 21 New ### [Software Engineer, Security Observability](https://jobicy.com/jobs/151224-software-engineer-security-observability.md) About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI’s technology, people, and products…. * ![Synthesia logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/c69aad11-221.webp) Synthesia Oct 21 New ### [Application Security Engineering Manager](https://jobicy.com/jobs/146803-application-security-engineering-manager.md) Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Oct 20 New ### [Microsoft 365 Engineer](https://jobicy.com/jobs/155962-microsoft-365-engineer.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Paddle logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/28ca3645-221.png) Paddle Oct 20 New ### [Staff Systems Engineer](https://jobicy.com/jobs/155966-staff-systems-engineer.md) What do we do? Paddle offers digital product companies a completely different approach to their payment infrastructure. Instead of assembling and maintaining a complex stack of payments-related apps and services,… * ![Roboflow logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/8cd75e4b-221.webp) Roboflow Oct 20 New ### [Security Engineer](https://jobicy.com/jobs/153639-security-engineer-2.md) Who We Are Our mission is to make the world programmable. Sight is one of the key ways we understand the world, and soon this will be true for the… [Browse all jobs](https://jobicy.com/jobs.md)