Threat Hunter

About the role

Tanium is seeking a Threat Hunter to join our growing team of intrusion analysts focused on protecting our customers. You will utilize your background in cybersecurity and threat intelligence to evolve our threat hunting capabilities. In this capacity, you will act as a guide and partner to clients, helping them navigate complex security challenges with confidence and precision. The role requires a proactive mindset that constantly questions assumptions and seeks out hidden risks before they materialize into incidents. You will leverage your expertise to translate ambiguous security signals into clear, actionable intelligence for diverse audiences. This position is critical in bridging the gap between advanced threats and practical defensive measures within customer environments. Your work will directly influence the security maturity of organizations by enabling them to detect and disrupt adversarial activity more effectively.

Key facts

What you'll do

• Orchestrate comprehensive threat hunting exercises that follow the full lifecycle from hypothesis to remediation.
• Partner with clients to refine incident response plans and improve readiness for future disruptive events.
• Implement and optimize Tanium Security Operations solutions to align precisely with stipulated customer objectives.
• Synthesize intelligence from multiple feeds to construct bespoke detection rules that enhance situational awareness.
• Act as a primary technical liaison ensuring customers extract maximum value and efficiency from the Tanium Platform.
• Provide structured feedback to product teams based on direct interactions and observed customer behaviors in the field.
• Engineer automated API integrations and targeted hunting queries to establish security baselines and elevate protective measures.
• Investigate emerging trends in artificial intelligence, cloud infrastructure, containerization, and operational technology to advise stakeholders.
• Conduct in-depth analysis of endpoint telemetry to uncover stealthy techniques employed by advanced persistent threats.
• Develop custom dashboards and reporting artifacts that communicate the effectiveness of security controls to leadership.
• Facilitate knowledge transfer sessions that empower security teams to sustain and evolve their own detection capabilities.
• Collaborate with engineering and research groups to validate new sensor data and improve coverage across the attack surface.
• Perform iterative testing of detection logic to minimize false positives and maximize fidelity for critical alerts.
• Document methodologies and playbooks that standardize hunting processes and support scalability across client portfolios.

Requirements

• Possess a minimum of 5 years of cumulative experience in threat hunting, incident response, or defensive security operations.
• Demonstrate direct involvement in hands-on investigations where you analyzed artifacts and built detection hypotheses in production settings.
• Exhibit mastery over established incident response methodologies including scoping, containment, eradication, and post-incident review.
• Have a documented history of working with security technologies such as SIEM platforms, EDR agents, SOAR orchestration tools, and threat intelligence repositories.
• Bring prior experience in customer-facing engagements where you delivered technical guidance and resolved complex security issues.
• Show advanced competence in scripting and API consumption using languages such as Python or PowerShell to automate data workflows.
• Understand core concepts of detection engineering, threat intelligence lifecycle management, and visibility frameworks.
• Adapt communication styles to suit both technical practitioners and executive stakeholders during high-pressure scenarios.
• Navigate ambiguous requirements and translate business needs into concrete technical tasks without direct supervision.
• Maintain a strong sense of ownership for deadlines, quality of analysis, and adherence to service level expectations.
• Comply with organizational policies regarding data handling, confidentiality, and information security at all times.
• Work effectively within distributed teams that may span multiple time zones while maintaining alignment on shared goals.
• Commit to continuous learning to keep pace with evolving threats, tools, and methodologies in the cybersecurity domain.
• Uphold ethical standards and professional integrity when conducting assessments and reporting findings to clients.

Practical notes

The Threat Hunter position based in Tokyo, Japan operates under a hybrid work model, allowing for a combination of remote and on-site presence depending on project needs and team coordination. The engagement is full-time, aligning with standard business hours while potentially requiring flexibility to address urgent customer incidents outside of typical schedules. Travel requirements are generally limited to within the region, ensuring that the role remains primarily anchored in the Tokyo area without extensive international relocation expectations. Candidates must be legally authorized to work in Japan without requiring company-sponsored visa sponsorship, as the role does not include provisions for visa support or relocation assistance. There are no explicit compensation details published for this role in the available source information, so discussions regarding remuneration will be handled separately through established internal processes. Deadlines for application review are not specified, so interested candidates are encouraged to submit materials as promptly as possible while respecting stated hiring timelines. The position remains subject to change based on organizational priorities, team expansion needs, and evolving customer demands in the dynamic threat landscape.