Lead Threat Hunter

🔥 13 hours ago

🇺🇸 United States – Remote

💵 $120k - $175k / year

⏰ Full Time

🟠 Senior

🕵️ Threat Intelligence Specialist

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Allstate

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1931

💼 Consulting

📦 Logistics

🛡️ Insurance

💰 Post-IPO Equity on 2014-01

Consulting • Logistics • Insurance

Allstate is an industry leader in providing insurance solutions, focusing on home, auto, device, and identity protection. With a commitment to customer well-being, Allstate aims to instill peace of mind and financial security for its customers. The company also emphasizes community impact and sustainability through various initiatives, showcasing their dedication to social responsibility and positive change.

📋 Description

• Lead hypothesis-driven, intelligence-led threat hunting campaigns across enterprise, cloud, and OT/IoT environments • Design and execute custom analytics across SIEM, EDR/XDR, identity, cloud, and network telemetry • Hunt for identity, cloud, AI/LLM, adversary, and deception-related threats • Convert hunt findings into durable detections, signatures, and SOAR playbooks • Use AI and LLM-assisted tooling for query generation, log summarization, entity pivoting, anomaly clustering, and pattern discovery • Produce post-hunt reports with evidence and measurable exposure-reduction outcomes • Partner with Threat Intelligence to operationalize intelligence into hunt missions and collection requirements • Support purple team exercises and validate detection efficacy using adversary emulation campaigns • Develop and maintain custom tooling and automation for hunting, investigation, and analyst efficiency • Mentor junior hunters and contribute to knowledge bases, hunt libraries, and training • Support Incident Response, Forensics, and Insider Threat/Fraud investigations as a senior technical resource • Liaise across Cyber Operations and communicate findings to technical peers and executive leadership • Identify telemetry gaps and partner with engineering teams to improve collection coverage • Develop behavioral, anomaly-based, and baseline-deviation hunting methodologies

🎯 Requirements

• 7+ years of experience in security operations, including 4+ years dedicated to threat hunting • Deep experience hunting in large, complex enterprise environments • Experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs • Hands-on experience with modern SIEM platforms including Splunk, Sentinel, and Elastic • Hands-on experience with EDR/XDR platforms including CrowdStrike, Defender, SentinelOne, and Tanium • Experience using AI/LLM-assisted tooling for hunting, triage, and analytic development • Working knowledge of MITRE ATLAS, OWASP Top 10 for LLM Applications, and AI-specific threats • Working knowledge of the Diamond Model, Kill Chain, and Pyramid of Pain • Strong scripting and automation skills in Python, PowerShell, Go, and/or Bash • Understanding of TCP/IP, DNS, TLS, HTTP, SMTP, and common network/application protocols • Experience with CQL/KQL/SPL analytics, Sigma, YARA, Snort, and Suricata • Strong analytical, problem-solving, written, and verbal communication skills • Leadership and mentorship capability • Ability to learn new technologies and techniques independently • Demonstrated ownership of end-to-end hunting programs • Background investigation required • Allstate generally does not sponsor individuals for employment-based visas for this position • Dedicated private workspace and reliable internet with minimum speeds of 50 MB download and 5 MB upload when working from home • Desirable qualifications include cloud hunting, adversary emulation, malware analysis, AI/ML security, vulnerability research, container/Kubernetes security, deception technology, insider threat or fraud hunting, OT/ICS or IoT familiarity, relevant security certifications, and published research or open-source detection contributions

🏖️ Benefits

• Comprehensive technology setup including laptop, monitors, headset, keyboard, and mouse • Monthly connectivity reimbursement for employees eligible to work from home • Fully remote work arrangement • Opportunity for professional growth and skill development • Interview accommodations available upon request