Threat Lead; DSC​/JH

Lead ST Engineering's proactive, intelligence-led threat hunting services for enterprise, Operational Technology (OT) and Critical Information Infrastructure (CII) customers. Own the technical hunt lifecycle: threat intelligence → hypotheses → telemetry readiness → investigative queries → evidence validation → detection improvement→ customer reporting and incident/DFIR escalation. This is a hands‑on technical leadership role, not solely SOC alert triage or project coordination.

• Threat intelligence, hunt planning and methodology
  
  Define risk-based hunt strategies, monthly/ad hoc hunt plans, testable hypotheses, coverage objectives and measurable outcomes using customer operating context, critical assets and threat exposure.
  
  Assess cyber threat intelligence, threat actors/campaigns, indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs); map hypotheses and observations to MITRE ATT&CK Enterprise and ATT&CK forICS where relevant.
• Telemetry assessment and OT environment understanding
  
  Identify necessary log sources and artefacts across Windows/Linux hosts, OT engineering workstations, HMIs, authentication, privileged access, security devices, applications and networks; identify monitoring and evidential blind spots.
  
  Verify log ingestion and data quality, including parsing, timestamps, event coverage, field mapping, retention and searchability; direct technical remediation with SIEM/platform engineers before interpreting hunt results.
• Threat investigation and detection engineering
  
  Lead complex IOC-, TTP- and behavior-driven hunts, perform SIEM correlation and investigative pivots, distinguish normal OT maintenance/administration from malicious activity, and assure evidence-backed conclusions.
  
  Develop or review hunt analytics and detection use cases; coordinate testing, false-positive tuning and approved operational handover of SIEM/UEBA/EDR/XDR/SOAR detection improvements to SOC or detection engineering teams.
• Findings, customer communication and DFIR escalation
  
  Review findings, severity and confidence; present clear technical reports, recommended actions, telemetry limitations and senior-stakeholder briefings, with documented assumptions and evidence.
  
  Escalate credible malicious activity promptly via agreed customer and 24×7 SOC channels; coordinate handover to Incident Response/DFIR teams, preserving event timelines, affected assets, hunt logic and supporting evidence.
• SOC integration, service coordination and leadership
  
  Work closely with L1/L2/L3 SOC analysts operating 24×7×365, CTI, platform engineering, detection engineering and DFIR functions; establish escalation criteria, investigation handoffs and incident feedback loops.
  
  Mentor hunters, review technical outputs, maintain procedures, hunting content and improvement backlog; provide workload forecasts and surge-support needs to the SOC/Service Delivery Manager for manpower planning.

• Cybersecurity seniority:
  At least 7 years of relevant cybersecurity experience, including a minimum of 5 years in OT/ICS cybersecurity for engagements requiring that contractual threshold.
• Specialist experience:
  At least 3 years of demonstrable hands‑on threat hunting, advanced incident investigation/DFIR or detection engineering, including technical ownership of end-to-end hunts; experience in customer-facing technical delivery.
• Core technical skills:
  Strong working knowledge of cyber threat intelligence, ATT&CK, threat hypotheses, Windows/Linux and network artefacts, SIEM correlations, investigation techniques, query development and evidence interpretation.
• OT and security stack:
  Knowledge of OT/ICS assets and architecture, OT asset management, patch management, Privileged Access…