Senior Threat Specialist

We are hiring a Senior Threat Hunting Specialist who combines deep threat-hunting expertise with practical purple-team simulation skills to support an AI-driven detection program. The ideal candidate understands attacker TTPs in depth, can design hypothesis-driven hunts from telemetry, and can script concise attack simulations to generate realistic logs and telemetry in a test environment for validating detections. This role focuses on attacker thinking, preparing and conducting simulations, threat detection SIEM query design and SOC detection validation.

Moreover, this role will contribute to features design for ML-driven detection capabilities.

• Perform hypothesis-driven threat hunting projects and translate attacker TTPs into measurable telemetry signals (IOAs/IOCs) suitable for ML feature design.
• Collaborate with ML engineers and data scientists to define, propose, and validate candidate features.
• Specify feature engineering transformations, labeling rules, sampling strategies, and evaluation metrics; support feature importance and explainability analysis.
• Create hypothesis-driven detection reports and dashboards from telemetry sources and perform threat hunting investigations using the insights surfaced by those reports.
• Design and execute controlled red-team style simulations (scripted PoCs) in test environments to create labeled datasets for training and validation; ensure simulations are realistic, diverse, and safely scoped.
• Track emerging threats, map them to MITRE ATT&CK, and propose new simulation scenarios and detection features as adversaries evolve.

• 5+ years’ experience in threat hunting, SOC/IR, Blue ed urple team experince, or related security roles with demonstrable hunting casework.
• Strong understanding of attacker techniques and the ability to decompose attack chains (MITRE ATT&CK fluency).
• Proven ability to propose hunting hypotheses and identify relevant telemetry fields/signals.
• Experience collaborating with ML or data science teams to define feature requirements, labeling strategies, and validation criteria.
• Proficient with Click House and Postgre
  
  SQL, and able to produce clear, high-quality security analysis reports based on telemetry and hunting findings.
• Practical scripting ability for attack simulation and PoC generation (Python required; Power Shell/Bash/other scripting as applicable).
  
  Note:
  
  production engineering and model training are handled by the team.
• Familiarity with common hunting/detection platforms and telemetry sources (SIEM, EDR/XDR, network and cloud logs, container telemetry).
• Strong analytical reasoning, incident investigation mindset, and excellent written/verbal communication skills.

• Industry certifications: GIAC GCFA, GCTI, OSCP/OSCE.
• Hands-on red team / adversary emulation experience beyond simple PoCs.
• Familiarity with SOAR products and concepts.
• Familiarity with ML concepts and validation metrics.
• Familiarity with Fortinet product telemetry and tooling — e.g., Forti Analyzer and Forti
  
  SIEM for aggregated and correlation logs, Forti Gate traffic/event logs, and Forti
  
  EDR endpoint telemetry. Able to map Fortinet event fields to hunting features and to explain which Fortinet logs provide the signals needed for specific TTPs.

Join our team, known for its collaborative ethos, working seamlessly with global customers, internal engineering teams and product development groups. Our team culture emphasizes continuous learning, innovation, and a strong commitment to customer satisfaction. We embrace Fortinet’s core values of openness, teamwork and innovation, fostering an environment where team members support each other, share knowledge, and leverage AI to solve complex technical challenges.

Our inclusive and dynamic team thrives on collaboration and is driven by the shared goal of maintaining Fortinet’s high standards of excellence in cybersecurity solutions.

We encourage candidates from all backgrounds and identities to apply. We offer a supportive work environment and a competitive Total Rewards package to support you with your…