Company: ecom.tech
Format: full remote
Location: Moscow
Salary: 550,000 — 600,000 RUB/month before taxes
Publication Date: 23.10.2026
Responsibilities:
- Development and enhancement of the proactive threat detection and Threat Hunting program in the Company, including methodology, research prioritization, hunting backlog, and performance evaluation criteria;
- Organization of proactive search for previously undetected attacker activity using intelligence-driven, hypothesis-driven, TTP/behavior-based, IOC-driven, and data-driven approaches;
- Identification of priority Threat Hunting areas based on the current threat landscape, critical assets, and Company business processes, Threat Intelligence data, investigation results, Red/Purple Team activities, and identified monitoring gaps;
- Organization of research and adaptation of attacker tactics, techniques, and procedures (TTPs) to the Company's infrastructure using MITRE ATT&CK and other recognized industry models;
- Organization of the indicator of compromise (IOC) lifecycle: collection, enrichment, verification, relevance and reliability assessment, updating, contextualization, and application of IOCs in hunting and detection processes;
- Organization of telemetry and threat detection capability gap identification; formulation of requirements for event sources, monitoring tools, and Detection Engineering;
- Ensuring the transformation of Threat Hunting results into continuous defense mechanisms: detection scenarios, monitoring requirements, response scenarios, hardening recommendations, and subsequent research;
- Formation of analytical and foresight reporting on the threat landscape: relevant attacker groups for the Company, campaigns, TTP changes, new attack vectors, probable threat development scenarios, and indicators of their implementation;
- Ensuring the quality of analytical materials: assessing source reliability, documenting assumptions and limitations, level of confidence in analytical conclusions, and alternative scenarios;
- Organization of group interaction with monitoring and response teams, Detection Engineering, DFIR, Threat Intelligence, Vulnerability Management, AppSec, Red/Purple Team, and information system owners;
- Expert review of complex investigations and hunting cases, development of the group's knowledge base and methodology, and development of employee competencies.
We expect you to have:
- Experience in Threat Hunting, Threat Intelligence, DFIR, Detection Engineering, or SOC, preferably at least 5 years, including technical leadership experience;
- Deep knowledge of modern computer attack tactics, techniques, and procedures, and MITRE ATT&CK Enterprise;
- Knowledge of Threat Hunting methodology: hypothesis-driven, intelligence-driven, TTP/behavior-based, IOC-driven, and data-driven approaches;
- Understanding of Cyber Threat Intelligence processes, methods for analyzing threat actors, campaigns, attacker infrastructure, and the interrelationships between IOCs and TTPs;
- Understanding of principles for assessing source reliability, analytical confidence, uncertainty, and alternative hypotheses;
- Deep understanding of corporate IT infrastructure architecture, Windows/Linux, network infrastructure, Identity/AD, cloud, and SaaS services;
- Practical understanding of the capabilities of SIEM, EDR/XDR, NDR, network monitoring systems, and security telemetry sources;
- Experience in building and analyzing search queries on large volumes of security events and conducting retrospective investigations;
- Understanding of Detection Engineering principles and the transformation of research results into robust detection mechanisms;
- Knowledge of Cyber Threat Intelligence exchange principles and STIX/TAXII formats;
- Practical skills in data analysis automation, preferably Python and/or PowerShell/Bash;
- Skills in preparing technical, analytical, and management materials for various audience levels;
- Experience in organizing the work of an expert team and interacting with technical and business units.
