Threat Hunting Analyst

<div class="content-intro"><p><strong>Build the Future with AspenView Technology Partners</strong></p> <p>At AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.</p> <p>As we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.</p></div><p><strong>Why Join AspenView?</strong></p> <p>At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.</p> <p>Here’s what you can expect:</p> <ul data-pattern="discCircleSquare" data-depth="1"> <li>Competitive base</li> <li>Flexible work model: hybrid, remote, or in-office</li> <li>Real growth opportunities and leadership visibility</li> <li>Inclusive, respectful culture that blends U.S. innovation with Colombian heart</li> <li>A company that listens, invests in you, and celebrates wins together</li> </ul> <p> </p> <p id="p-rc_e8d2ed2f88f32c05-492" data-path-to-node="15">We are seeking a <strong>Threat Hunter Analyst </strong> to join the security operations team of a large US consumer lender in the financial services sector, working <strong>on-site</strong> from AspenView's secure suite in <strong>Bogotá, Medellín or Buenos Aires</strong>. You'll design and run hypothesis-driven hunts across endpoint, identity, network, email and AWS telemetry in Elastic, reporting to the on-site Threat Hunting Lead and working closely with Detection Engineering so that every good hunt ends as a working detection. This is a hands-on role for someone who can take raw intelligence and turn it into a hunt without being told how, and who knows what living-off-the-land, credential abuse and lateral movement look like in real logs, not just someone who has triaged alerts from a queue.</p> <h4 id="p-rc_e8d2ed2f88f32c05-503" data-path-to-node="16"><span class="citation-1793 citation-1794 citation-end-1794">What you will do:</span></h4> <h4 data-path-to-node="17">Hunt Design & Threat Intelligence</h4> <h3 id="p-rc_e8d2ed2f88f32c05-504" data-path-to-node="17"></h3> <ul> <li id="p-rc_e8d2ed2f88f32c05-493" data-path-to-node="18,0,0">Build hunts from threat intelligence relevant to US consumer finance, recent incidents and known telemetry gaps</li> <li id="p-rc_e8d2ed2f88f32c05-494" data-path-to-node="18,1,0">Turn raw intelligence into testable hypotheses on your own</li> <li data-path-to-node="18,1,0">Decide which data sources and timeframes will answer each hunt question</li> <li data-path-to-node="18,1,0">Map attacker tradecraft to MITRE ATT&CK to shape and prioritize hunts</li> </ul> <h4 data-path-to-node="19">Hunt Execution & Investigation</h4> <h3 id="p-rc_e8d2ed2f88f32c05-505" data-path-to-node="19"></h3> <ul> <li id="p-rc_e8d2ed2f88f32c05-495" data-path-to-node="20,0,0">Run scheduled and ad hoc hunts across CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic</li> <li id="p-rc_e8d2ed2f88f32c05-496" data-path-to-node="20,1,0">Pivot quickly when an initial query surfaces something worth chasing</li> <li data-path-to-node="20,1,0">Separate real findings from noise</li> <li data-path-to-node="20,1,0">Escalate live attacker activity to Tier 3 and the Incident Response Lead with the evidence attached</li> <li data-path-to-node="20,1,0">Run indicator and behaviour sweeps during major incidents to scope how far an attacker reached</li> </ul> <h4 data-path-to-node="21">Detection Engineering Partnership</h4> <ul> <li id="p-rc_e8d2ed2f88f32c05-497" data-path-to-node="22,0,0">Hand candidate detections to Detection Engineering, written well enough to build from</li> <li id="p-rc_e8d2ed2f88f32c05-498" data-path-to-node="22,1,0">Identify logging gaps and document them for remediation</li> <li data-path-to-node="22,1,0">Make sure your hunts end as production detection rules</li> </ul> <h4 data-path-to-node="23">Reporting & Knowledge Sharing</h4> <ul> <li id="p-rc_e8d2ed2f88f32c05-499" data-path-to-node="24,0,0">Write clear, reproducible hunt reports covering what was tested, found, ruled out and couldn't be tested</li> <li id="p-rc_e8d2ed2f88f32c05-500" data-path-to-node="24,1,0">Walk the client's security team through findings directly, in English</li> <li data-path-to-node="24,1,0">Document hunts so anyone on the team can rerun them</li> </ul> <p id="p-rc_e8d2ed2f88f32c05-501" data-path-to-node="25"><span data-path-to-node="25,0"><strong>Tools & Technologies:</strong> </span></p> <ul> <li data-path-to-node="25"><strong>Platforms & Infrastructure:</strong> Elastic Security (EQL, ES|QL), Splunk or Microsoft Sentinel (equivalent SIEMs), Palo Alto, Proofpoint</li> <li data-path-to-node="25"><strong>Security & Threat Intelligence:</strong> CrowdStrike Falcon, Microsoft Defender, SentinelOne, MITRE ATT&CK, MISP, OpenCTI, Recorded Future, FS-ISAC, malware triage and memory forensics</li> <li data-path-to-node="25"><strong>Cloud & Data Analysis:</strong> AWS (control-plane and cloud telemetry), Okta (ide