Vulnerability Management​/Threat Consultant, onsite | Revel IT

OUR GOAL: Treat our consultants and clients the way we would like others to treat us! Interested in joining our team? Check out the opportunity below and apply today!

We are looking for a Vulnerability Management / Threat Hunting Consultant focused on Threat Hunting to proactively identify suspicious, abusive, fraudulent, or adversarial activity across a large-scale digital ecosystem. In this role, you will use data analysis, security expertise, investigative thinking, and cross-functional collaboration to uncover emerging threats, identify detection opportunities, and improve the organization’s ability to detect, understand, and respond to malicious or anomalous behavior.

You will work across high-volume telemetry, security events, product signals, identity data, device or client data, request logs, and other behavioral datasets to develop hypotheses, execute hunts, validate findings, and convert discoveries into durable security outcomes.

• ONSITE – 5 days/week at the client’s headquarters in Chicago (downtown in the loop)
• Location (Time Zone):
  Central
• Citizenship: US Citizen

This role is ideal for someone who enjoys working with ambiguous security questions, finding patterns in complex data, and turning investigative insights into detections, dashboards, mitigations, and measurable risk reduction.

• Develop and execute proactive threat hunts across large-scale security, product, identity, device, network, and application telemetry.
• Formulate clear investigative hypotheses around adversary behavior, fraud, abuse, automation, account compromise, credential attacks, platform misuse, data misuse, and anomalous activity.
• Analyze high-volume request, authentication, session, device, client, and application logs to identify suspicious patterns and emerging threats.
• Identify new behavioral signals that can improve anomaly detection, classification, fraud prevention, abuse detection, and security monitoring.
• Build repeatable analyses that distinguish normal behavior from suspicious, automated, abusive, or adversarial activity.
• Investigate anomalous request patterns, error patterns, device behavior, account behavior, and access activity to identify potential risks or control gaps.
• Develop dashboards, metrics, and reporting that communicate threat activity, detection coverage, security posture, and risk trends to technical and non-technical stakeholders.
• Partner with detection engineering, incident response, product security, fraud, data science, platform engineering, and product teams to turn hunt findings into durable controls.
• Recommend improvements to logging, telemetry, instrumentation, alerting, detection logic, and response workflows.
• Document hunt plans, investigative methods, findings, assumptions, evidence, limitations, and recommended actions.
• Help mature the threat hunting practice by improving hunt planning, outcome tracking, signal development, data quality, and detection feedback loops.

• Are there account behaviors that suggest credential stuffing, account takeover, session hijacking, or unauthorized access?
• Are there abnormal request patterns that suggest automation, scraping, abuse, bot activity, or scripted interaction?
• Are attackers adapting their behavior in ways that current detections do not capture?
• Are there device, client, API, or application attributes that correlate with suspicious or high-risk behavior?
• Are there unusual authentication, authorization, session, or access patterns across users, services, regions, or platforms?
• Are existing detections producing meaningful security value, or do they need better signals, thresholds, enrichment, or tuning?
• Are there telemetry gaps that prevent the organization from confidently detecting or investigating specific threats?
• Are there recurring anomalies that indicate product abuse, control bypass, misconfiguration, or emerging adversary tradecraft?

Threat Hunting and Investigation

• Lead structured threat hunts from initial question through analysis, validation, documentation, and follow-up action.
• Translate threat intelligence, incident trends, fraud patterns, abuse reports, and security…