Lead Threat Hunter

Allstate

Confirmed live yesterday High trust
Remote

Quick summary

Work type
Remote
Location
IL
Salary
$120,000–$175,000 / yr
Employment
Full-time
Posted
3 days ago
Freshness
Confirmed live yesterday
Nearby
99+ roles within 25 mi

Market check

Salary context

Below market

How this pay compares to similar roles

Similar $177k
This role $148k
$108k $232k
below market most similar roles pay here above market

This role pays less than 80% of similar roles. Most pay $157,937–$196,343 — the blue band above. At the midpoint, this role pays about $148k versus about $177k for comparable roles.

Based on 240 similar postings.

Employer

About Allstate

The Allstate Corporation is one of the largest publicly held personal lines insurers in the US, widely recognized for its "You're In Good Hands With Allstate®" slogan.

Allstate currently has 52 open roles on FindRole.

Listed pay typically runs $100,000–$170,500 across 51 roles with salary data.

Most-posted roles

View all roles at Allstate

At a glance

TL;DR · Lead Threat Hunter

Role Posting Log in to save

The Lead Threat Hunter will join the Cyber Operations team to lead hypothesis-driven, intelligence-led hunt campaigns across enterprise, cloud, and OT/IoT environments. This role involves proactively identifying adversary tradecraft that evades existing detections, operationalizing findings into durable detection logic, and performing identity-centric hunting across Entra ID, Active Directory, and SaaS platforms. The hunter will execute custom analytics against large-scale security telemetry using SIEM, EDR/XDR, and cloud-native tools. Key technologies include Splunk, Sentinel, Elastic, CrowdStrike, Defender, and SentinelOne, alongside AI and LLM-assisted tooling for query generation and anomaly clustering. The role addresses technical challenges such as token theft, MFA bypass, and AI-specific threats like prompt injection or model abuse, while utilizing frameworks like MITRE ATT&CK, the Diamond Model, and the Pyramid of Pain.

Skills

Threat Hunting MITRE ATT&CK SIEM EDR XDR Python PowerShell Go Bash AWS Azure M365 Splunk Sentinel Elastic CrowdStrike Defender SentinelOne Tanium KQL SPL Sigma YARA Snort Suricata SOAR TCP/IP DNS TLS HTTP SMTP Kubernetes AI LLM RAG Atomic Red Team CALDERA Stratus Red Team Diamond Model Pyramid of Pain Kill Chain MITRE ATLAS OWASP Top 10 for LLM Applications

What you'll do

  • Lead hypothesis-driven, intelligence-led hunt campaigns across enterprise, cloud, and OT/IoT environments.
  • Design and execute custom analytics against SIEM, EDR/XDR, identity, and network telemetry to uncover adversary tradecraft.
  • Perform identity-centric hunting for token theft, session hijacking, MFA bypass, and OAuth abuse across Entra ID and SaaS platforms.
  • Conduct cloud-native hunting across AWS, Azure, and M365 control planes using audit logs and workload telemetry.
  • Convert hunt findings into durable detections, signatures, and SOAR playbooks to close the hunt-to-detect loop.
  • Hunt within AI and LLM environments for threats like prompt injection, model abuse, and data exfiltration.
  • Produce post-hunt reports with explicit evidence and measurable outcomes tied to enterprise exposure reduction.
  • Develop and maintain custom tooling and automation to improve hunting efficiency and investigation capabilities.

What we're looking for

  • 7+ years of experience in security operations with 4+ of those years dedicated to threat hunting.
  • Deep experience hunting in large, complex enterprise environments.
  • Demonstrable experience executing MITRE ATT&CK-aligned hunts with documented outcomes and detection handoffs.
  • Hands-on experience with modern SIEM (Splunk, Sentinel, Elastic) and EDR/XDR (CrowdStrike, Defender, SentinelOne, Tanium).
  • Demonstrated experience using AI/LLM-assisted tooling to accelerate hunting, triage, and analytic development.
  • Working knowledge of hunting in AI/LLM environments, including MITRE ATLAS and OWASP Top 10 for LLM Applications.
  • Working knowledge of threat intelligence frameworks including the Diamond Model, Kill Chain, and the Pyramid of Pain.
  • Strong scripting and automation skills in Python, PowerShell, GO, and/or Bash.

Related searches

More Lead Threat Hunter jobs Remote Lead Threat Hunter jobs All jobs at Allstate

More like this

Similar roles

Lead, Cyber Defense & Response

Prudential Financial

Newark, NJ 82 days ago
Splunk KQL SIEM XDR AWS Azure M365 Active Directory Entra MITRE ATT&CK Cyber Kill Chain Incident Response Detection Engineering Threat Hunting
5+ yrs exp
Save

Lead Detection Engineer, Cyber Defense & Response

Prudential Financial

Newark, NJ 36 days ago
Splunk Enterprise Security SPL KQL Python SOAR CI/CD MITRE ATT&CK Cyber Kill Chain Incident Response Threat Hunting Cyber Threat Intelligence Digital Forensics Windows Linux macOS Security Automation Telemetry Pipelines
Save

Lead, Incident Response

Prudential Financial

Newark, NJ 7 days ago $123,700–$204,100
Digital Forensics Incident Response Python PowerShell Bash Splunk KQL AWS Azure M365 Active Directory Entra XSOAR EDR X-Ways EnCase MITRE ATT&CK Cyber Kill Chain
5+ yrs exp
Save

Lead Detection & Response Platform Engineer

CoStar Group

Arlington, VA +1 7 days ago $155,000–$245,000
SIEM XDR SOAR Python PowerShell KQL SPL REST APIs JSON Git Terraform Bicep ARM Azure AWS Sentinel Defender XDR Logic Apps Entra ID Active Directory CI/CD MITRE ATT&CK NIST SP 800-61
8+ yrs exp Hybrid
Save

Cyber Threat Hunter

Booz Allen Hamilton

McLean, VA 7 days ago $69,400–$158,000
Threat Hunting MITRE ATT&CK EDR XDR SIEM KQL Python PowerShell Digital Forensics Incident Response SentinelOne CrowdStrike Falcon Palo Alto Cortex XDR Microsoft Defender for Endpoint Microsoft Sentinel Cyber Threat Intelligence
3+ yrs exp
Save