Threat Hunter
Hypothesis-driven hunts across telemetry, proactive, low-alert, high-judgment.
Small market, senior-leaning. Few true junior hunter roles exist.
Read the full role verdict and reasoning
Hypothesis-led investigation that tests what available telemetry can and cannot reveal.
- Domain
- Cybersecurity
- Entry
- £32–40k
- Senior
- £52–65k
- You can frame a hypothesis and disprove it without ego
- You're fluent in at least one query language under pressure
- You read threat intel like a working document, not a magazine
- You're comfortable working without alerts to react to
- You've never run a structured investigation end-to-end
- You want a clean queue, hunting is open-ended by design
- You expect the title to come without the IR and detection background it assumes
What "doing well" looks like in the seat
- Your hunts produce detections that ship and stay shipped
- You find live activity that the alerting pipeline missed
- Your writeups change how the SOC thinks about a TTP
- Red team starts adjusting because of your work
A hunting title can include routine triage. Ask about protected investigation time, data coverage and how negative findings and visibility gaps are documented.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
High, senior hunter / threat research lanes pay well.
Who actually gets in
- +Detection Engineer
- +Senior SOC
- +IR analyst
Common misconceptions
- −That tooling makes the hunter, it's domain knowledge and patience.
Where this leads
- Detection Engineering
- CTI Analyst
- IR
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Tech you'll see
- Splunk
Pathways that pass through here
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.
Where this fits