Senior Threat Hunter (SOC L3) - Hybrid

About the role

EY GDS Spain is looking for a Senior Threat Hunter (SOC L3) in Malaga, working in a hybrid setting. The role proactively identifies advanced, stealthy and previously unknown threats across enterprise environments, going beyond alert-driven SOC operations. It focuses on hypothesis-based threat hunting, adversary behaviour analysis and closing detection gaps across Microsoft Sentinel, Microsoft Defender for Endpoint and Defender for IoT, while supporting L1/L2 analysts and partnering with Incident Response and Detection Engineering teams.

Key responsibilities

• Conduct hypothesis-driven, TTP-centric threat hunts using telemetry from Microsoft Sentinel and Microsoft Defender platforms
• Develop hunt hypotheses from adversary campaigns, MITRE ATT&CK techniques, threat intelligence and observed environmental weaknesses
• Hunt for advanced attack behaviours and validate findings with evidence before escalation
• Perform advanced KQL-based hunting across large data volumes in Microsoft Sentinel
• Identify detection blind spots, noisy analytics and data quality issues
• Run advanced endpoint hunting with Defender Advanced Hunting and correlate endpoint telemetry with SIEM data to reconstruct kill chains
• Hunt across IoT/OT and ICS environments using Microsoft Defender for IoT telemetry where applicable
• Produce formal threat hunt reports with hypothesis, data sources, findings and evidence, MITRE ATT&CK mapping and remediation recommendations

Required profile

• 4-7+ years in SOC, Threat Hunting, Incident Response or Detection Engineering
• Bachelor's or master's degree in computer engineering, IT security, computer science, information systems or a related field
• Highly proficient English with good written and oral communication
• Experience in enterprise-scale SIEM and EDR environments

Required skills

• Advanced expertise in Microsoft Sentinel and Defender Suites
• Strong mastery of KQL (Kusto Query Language)
• Deep understanding of MITRE ATT&CK, adversary tradecraft, malware and post-exploitation techniques
• Endpoint telemetry analysis, network traffic analysis and log correlation across security layers

What we offer

• Tailored training and development programmes
• Hybrid work model
• Wellness initiatives including psychological support sessions and health resources
• Volunteering opportunities and performance recognition programmes