This role pays more than
56%
of similar roles. Most pay
$139,200–$185,000
— the shaded band above.
At the midpoint, this role pays about
$164k
versus about
$162k
for comparable roles.
Based on 240 similar postings.
Employer
About Prudential Financial
Prudential Financial is a global financial services leader and premier active global investment manager.
Prudential Financial currently has
32 open roles
on FindRole.
Listed pay typically runs
$123,700–$202,050
across 32 roles with salary data.
Lead, Cyber Defense & Response serves as a senior technical lead for proactive threat hunting operations across on-prem and cloud environments. Reporting to the Director of Threat Hunting, this individual leads complex hunts from hypothesis development through operationalization while mentoring other hunters. The role involves analyzing telemetry from Active Directory, M365, Azure, AWS, endpoints, identity, network, and applications to identify suspicious patterns. Key responsibilities include translating hunt findings into durable defensive improvements, partnering with Cyber Threat Intelligence and Detection Engineering, and improving enterprise visibility. Candidates must possess expertise in SIEM/XDR platforms, Splunk SPL, and Microsoft KQL. The role requires a deep understanding of adversary TTPs, the MITRE ATT&CK framework, and the Cyber Kill Chain to address risks like credential access and lateral movement within a complex financial services infrastructure.
Lead proactive threat hunts across on-prem and cloud environments including identity, network, and application telemetry.
Develop and refine hunt hypotheses based on emerging threats, adversary TTPs, and vulnerability trends.
Execute advanced investigations using SIEM/XDR platforms with Splunk SPL and Microsoft KQL to identify suspicious patterns.
Translate hunt findings into durable defensive improvements such as new detection logic, use cases, and prioritized telemetry gaps.
Partner with Cyber Threat Intelligence to convert intelligence into specific hunting plans and measurable coverage.
Provide technical leadership and coaching to threat hunting staff regarding methodology, documentation, and knowledge sharing.
Support incident response by performing scoping hunts during active incidents to identify persistence and lateral movement.
Improve program maturity by refining playbooks, workflows, metrics, and reporting for threat hunting operations.
What we're looking for
Must have 5+ years of experience in cyber threat hunting, incident response, detection engineering, or security operations in large enterprise environments.
Must demonstrate experience conducting investigations across endpoint, identity, network, and cloud telemetry in complex environments.
Must possess strong proficiency with at least one major SIEM/XDR ecosystem and advanced query authoring.
Preferred experience includes hands-on work with Splunk SPL and/or Microsoft KQL.
Must have working knowledge of attacker tradecraft including credential access, persistence, lateral movement, and data exfiltration.
Must possess a strong understanding of adversarial frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
Must have experience designing or improving hunt programs, including workflows, metrics, reporting, and knowledge management.
Must hold at least one industry standard certification such as GIAC (GCIA, GCIH, etc.), Microsoft (SC-200, AZ-500), or CompTIA CySA+.