AI Threat Hunting Automation Developer

Delven Labs

Remote · $160k – $200k / year · Full-time · Posted 5 months ago

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

About the role

Threat hunting is what happens after the detection system fails. Security analysts look for signs of adversary presence that evaded automated detections — unusual process execution patterns, lateral movement indicators, data staging behaviors. Today it is manual, slow, and limited by analyst bandwidth. We automate the first two hours of every hunt. Our threat hunting automation platform ingests EDR telemetry, network flows, and authentication logs, then runs hypothesis-driven queries that surface the behavioral patterns associated with known attack techniques. The result is a prioritized investigation queue rather than an undifferentiated flood of raw events. You'll build the ML layer that powers hypothesis generation: the models that learn what normal looks like for each environment, the anomaly scoring that surfaces deviations worth investigating, and the natural language query interface that lets analysts describe a hunting hypothesis in English and receive structured query results.

Fully remote.

Responsibilities

Build environment-specific baseline models for user and entity behavior
Develop anomaly scoring that distinguishes hunt-worthy deviations from normal variation
Design natural language query interface for hypothesis-driven threat hunting
Implement hypothesis templates for MITRE ATT&CK technique coverage
Build evidence correlation models linking related anomalous events across data sources
Test systems against real-world attack simulations in our lab environment

Requirements

6+ years in ML engineering or security engineering with threat hunting or SIEM experience
Experience with behavioral analytics, UEBA, or anomaly detection on security telemetry
Strong Python and SQL skills for large-scale event data analysis
Understanding of MITRE ATT&CK framework and common attack patterns
Security certifications such as CISSP, GCIH, or equivalent preferred