Threat Hunter

Location: Vasanthanagar

About Angel One:

Angel One is one of India’s fastest growing fin-techs, on a bold mission to make investing simple, smart, and inclusive for every Indian. With over 3+ crore clients, we’re building at scale – and building for impact.

Our Super App helps clients manage their investments, trade seamlessly, and access financial tools tailored to their goals. We are working to build personalized financial journeys for our clients, powered by new-age tech, AI, Machine Learning and Data Science.

We're a builder's company ’ll have the space to experiment, the freedom to move with velocity, and the mandate to make bold, user-first decisions – every single day.
The vibe? Think less hierarchy, more momentum. Everyone has a seat at the table and a shot to build something that lasts.

Be part of a team that’s scaling sustainably, thinking big, and building for the next billion.

Why You'll Love Working at Angel One!

Tech Systems that run at Scale:  From AI to real-time data infra, you’ll work on tech that’s ahead of the curve and solve problems that truly matter.
Build one of India’s Leading Fintech Platform:  We’re not just disrupting finance – we’re shaping how billion Indians access wealth.
Own It. Drive It. Scale It:  You’ll have the freedom to lead, the resources to build, and the opportunity to leave your mark.
Empowered Growth:  We invest in your growth and empower you to explore your full potential.
Exceptional Benefits:  Our comprehensive benefits package includes health insurance, wellness programs, learning & development opportunities, and more.

Role:  Threat Hunter

Location:

Bangalore (Hybrid)

Lead end-to-end threat hunting activities — hypothesis-driven, intelligence-driven, and anomaly-based — across enterprise, network, endpoint,
and cloud environments.

• Design and maintain a threat hunting program aligned to MITRE ATT&CK, NIST CSF/SP 800-53, PCI-DSS, RBI Cyber Security Framework,
ISO/IEC 27001, and SANS/PEAK hunting methodologies.

• Work hands-on within the SOC to triage, investigate, and hunt for advanced threats, APTs, insider threats, and BFSI-specific fraud/TTPs (e.g.,
banking trojans, SWIFT/payment fraud, credential theft).

• Develop and refine hunting hypotheses using threat intelligence (CTI), MITRE ATT&CK TTP mapping, and IOC/IOA analysis.

• Build and tune detection content, hunting queries, and analytics in SIEM/EDR/XDR/SOAR platforms; convert successful hunts into automated
detections.

• Perform threat hunting across cloud environments (AWS/Azure/GCP), including cloud-native logs, IAM misuse, container/K8s threats, and CSPM
findings.

• Correlate hunting findings with vulnerability management, red/purple team exercises, and incident response to strengthen detection coverage.

• Mentor SOC analysts (L1/L2) in hunting techniques; lead knowledge-sharing sessions and build institutional hunting playbooks/runbooks.

• Support regulatory and audit requirements specific to BFSI (RBI, SEBI, IRDAI guidelines) through documented hunting evidence and metrics.

• Present hunting outcomes, threat trends, and risk insights to CISO/security leadership.

Who you are:

7–10 years in cybersecurity, with at least 4–5 years in SOC operations and dedicated threat hunting.

• Strong hands-on experience with SIEM (Splunk, QRadar, Sentinel, Google Sec Ops/Chronicle), EDR/XDR (Crowd Strike, Sentinel One, Defender),
and SOAR platforms.

• Solid understanding of MITRE ATT&CK, Cyber Kill Chain, Diamond Model, and TTP-based hunting methodologies.

• Working knowledge of cloud security across AWS/Azure/GCP — cloud logging, IAM, network flow logs, and cloud threat detection (strongly
preferred).

• Experience with scripting/query languages (KQL, SPL, Python, or similar) for hunt automation and analytics.

• Familiarity with BFSI threat landscape: payment fraud, SWIFT security, banking malware, insider risk, and regulatory expectations
(RBI/SEBI/IRDAI).

• Strong knowledge of network protocols, Windows/Linux internals, malware analysis fundamentals, and digital forensics.

• Excellent analytical, documentation, and stakeholder communication skills.
Preferred Certifications & Training

• GIAC: GCTI (Cyber Threat Intelligence), GCFA (Forensic Analyst), GCIH…