Updated April 8th, 2020
What does it mean to be a Threat Hunter?
With newsworthy breaches occurring nearly on a weekly basis, organizations need to pursuing precautionary strategies to minimize the possibility of a breach. Threat hunters combine research and analytical tools to comb through networks and data sets to track current and potential threats that may circumvent current automated tools.
The amount of adversaries within the cybersecurity industry is rising each year and no industry is safe. The Huffington Post outlines the recurring cybersecurity threats in the first half of 2017 ranging from ransomware in the healthcare industry to breaching the networks of pop-culture, motion picture entertainment organizations and releasing proprietary assets (i.e., Game of Thrones, Orange Is the New Black). Threat Hunting takes advantage of all available data sources, internal and external, to generate a comprehensive understanding of a threat landscape. Organizations are prioritizing cyber threat hunting into their security strategy.
A Day in the Life
Unlike Threat Intel Analysts, Threat Hunters use advanced hunting strategies that go beyond traditional detection techniques. In contrast to Penetration Testers who are focused on using tools and tactics to penetrate an organization’s network, Threat Hunters position watchful eyes to determine which behaviors on the network are innocuous and which are malicious.
A Threat Hunter begins with a hypothesis and focuses on questions he or she may want to answer. A successful Threat Hunting journey ends with answers to the original hypothesis and can include newly discovered Indicators of Compromise (IOCs) and tools, tactics and procedures (TTP) associated with current or potential adversaries. Before beginning a new iteration of the threat hunting process, it is imperative that the data is stored and documented in order to improve current automated detection mechanisms and analytics.
The mind of a Threat Hunter is not only creative; it’s instinctual. Threat Hunters do not wait for triggered-alerts to begin searching for potential threats. They proactively work and spend the majority of their time searching for the unknown, using educated hunches and hypotheses. To successfully identify advanced threats, a threat hunter’s approach must be dynamic and resilient. Hunters must be able to easily pivot between data sets and patterns to properly identify and evaluate the extent of an adversary’s digital footprint.
Most Valued Skills
- Information Security
- Information Systems
- LINUX
- Cryptography
- Network Security
Ready to build some of the foundational skills needed to become a Threat Hunter? For a limited time, CyberVista is offering free access to Critical Knowledge Explorer, our cybersecurity training program that provides individuals with the foundational knowledge needed to get a leg-up in the field. Register for free.
Recommended Certifications
Salary
Glassdoor lists available jobs in $53k-$116k, with an average of $76K. According to LinkedIn, as of April 8th, 2020, there are over 12,000 job openings related to Cyber Threat Hunters. Although the salary is financially appealing, cybersecurity professionals don’t aspire to become Threat Hunters for the money. The real reward for Threat Hunters lies within the satisfaction of uncovering threats.
Related Titles
- Threat Hunting Engineer
- Cyber Threat Analyst
- Security Engineer – Threat Detection
Doesn’t Sound Like You?
If the duties of threat hunting doesn’t appeal to your career interests, be sure to return for our next post in the Cybersecurity Roles blog series or check out our previous posts here:
- Cybersecurity Architect
- Incident Responder
- Malware Analyst
- Penetration Tester
- Cybersecurity Auditor
- SOC Analyst
- Threat Intel Analyst
- Vulnerability Management Analyst
- Network Administrator
