Threat Hunter Investigator

Piper Companies is seeking a Threat Hunter Investigator to join a leading technology organization based in Raleigh, NC
. This individual will be responsible for proactively identifying, investigating, and mitigating insider threats, whether malicious, negligent, or the result of a compromised account. The role will support investigations involving the protection of critical intellectual property and sensitive company data.
This is a fully remote opportunity working EST hours.

• Conduct proactive threat hunting and insider threat investigations leveraging logs, endpoint data, user activity, and behavioral analytics.
• Investigate potential intellectual property theft, data loss, and other insider risk events, documenting findings and recommendations.
• Develop and tune advanced threat detections within Splunk Enterprise Security using SPL.
• Build and maintain Risk-Based Alerting (RBA) use cases, correlation searches, and automated response workflows.
• Configure and optimize UEBA models and behavioral detections across endpoint, cloud, network, and application environments.
• Create technical documentation, runbooks, and detection content while continuously improving alert quality and coverage aligned to MITRE ATT&CK.

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field.
• 8+ years of experience conducting cyber investigations, insider threat analysis, and digital forensic investigations.
• Strong hands-on experience with Splunk Enterprise Security, including detection engineering and threat hunting.
• Advanced experience writing SPL queries and developing custom detections and correlation searches.
• Experience with RBA and UEBA, including risk scoring, anomaly detection, and behavioral analytics.
• Strong understanding of threat hunting methodologies and translating threat intelligence into actionable detections.

• Base salary ranging from $140,000 - $165,000
• Comprehensive benefits package including Medical, Dental, Vision, 401(k), PTO, paid holidays, and additional leave offerings where applicable

Keywords: Threat Hunting, Insider Threat, Incident Response, Splunk Enterprise Security, SPL, Detection Engineering, UEBA, RBA, Digital Forensics, Cybersecurity

#LI-REMOTE #LI-KI1