Threat Hunter

Piper Companies is seeking a Threat Hunter for a world-leading technology organization in the RTP, NC or Fulton, MD area. The Threat Hunter will have a strong background in threat hunting, Splunk, and cloud security, with hands-on experience in scripting and log analysis. This role is hybrid onsite (Tuesdays and Thursdays) in either Raleigh NC or Fulton, MD.

Responsibilities for the Threat Hunter include:

· Proactively hunt for cyber threats across on-premises and cloud environments (AWS and Azure)

· Utilize Splunk for advanced log analysis, threat detection, and incident response

· Analyze indicators of compromise (IOCs) and adversary tactics, techniques, and procedures (TTPs)

· Document threat findings in ticketing systems and oversee remediation efforts to closure

· Develop and implement threat hunting methodologies and playbooks

· Collaborate closely with SOC, Incident Response, and IT teams

· Provide actionable recommendations to improve threat detection and response

· Produce detailed reports on findings, actions taken, and remediation status

Requirements for the Threat Hunter include:

· 5+ years of professional threat hunting experience in enterprise environments

· Splunk Certification (e.g., Splunk Core Certified Power User, Splunk Enterprise Security Certified Admin)

· Strong scripting skills, especially in Splunk SPL query language

· Hands-on experience with AWS and Azure cloud platforms

· Proficiency in Python or PowerShell

· Familiarity with MITRE ATT&CK, cyber kill chain, and PEAK Threat Hunting Framework

· Experience with SIEM, EDR, and network security monitoring tools

· Must be eligible to work in the United States

· Ability to work onsite in RTP, NC or Fulton, MD on Tuesdays and Thursdays

Compensation for the Threat Hunter:

· $125,000–$132,000 annually

· Full comprehensive benefits package including medical, dental, vision, 401(k), PTO, and sick leave as required by law

· This job opens for applications on October 3rd, 2025. Applications will be accepted for at least 30 days from the posting date.

Keywords: Threat Hunter, Splunk, SIEM, Incident Response, Cloud Security, AWS, Azure, Python, PowerShell, MITRE ATT&CK, Cyber Threats, Hybrid Role, RTP, Fulton

#LI-HYBRID

#LI-HC1