Investigator (Remote/Telework)

Piper Companies is seeking a Threat Hunting Investigator to join a leading technology and cybersecurity organization for a long term remote consulting opportunity. The Threat Hunting Investigator will focus on identifying insider risk activity, developing advanced security detections, and protecting highly sensitive intellectual property through proactive investigations and threat analysis across enterprise environments.

Lead proactive threat hunting efforts utilizing endpoint, identity, cloud, and network telemetry to identify suspicious user behavior and insider risk activity.

Design, build, and optimize advanced detections, correlation searches, and risk-based alerting workflows within Splunk Enterprise Security and related security platforms.

Investigate potential intellectual property protection concerns through log analysis, digital forensics, and behavioral analytics across multiple data sources.

Transform threat intelligence, investigative findings, and MITRE ATT&CK techniques into scalable detection content, response procedures, and operational playbooks.

Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related technical discipline.

8+ years of experience conducting cyber investigations, insider threat analysis, incident response, threat hunting, or digital forensic examinations.

5+ years of hands‑on experience developing and maintaining security detections within Splunk, including SPL development, Enterprise Security, and Risk‑Based Alerting (RBA).

Strong understanding of endpoint security, Microsoft Defender, Microsoft Purview, cloud‑based telemetry, and user behavior analytics platforms.

Working knowledge of Cisco technologies, enterprise networking concepts, and the relationship between infrastructure assets and security monitoring programs.

Comprehensive Benefits: Medical, Dental, Vision, sick leave if required by law, and 401K

This job opens for applications on 10/1/26. Applications for this job will be accepted for at least 30 days from the posting date.

Keywords: threat hunting, insider threat, Splunk, SPL, threat detection, cyber investigations, digital forensics, incident response, SIEM, Splunk Enterprise Security, risk based alerting, RBA, UEBA, Microsoft Defender, Microsoft Purview, telemetry analysis, security operations, behavioral analytics, endpoint security, intellectual property protection, MITRE ATT&CK, correlation searches, cloud security, log analysis, threat intelligence, security engineering, cyber defense, insider risk management, network security, detection engineering, Cisco technologies, security monitoring, incident investigation, security analytics, SOC, enterprise security, forensic analysis, risk management, cybersecurity.

#LI-MB1 #LI-REMOTE

#