Lead Threat Researcher / Threat Hunter

We are partnering with a vulnerability intelligence and exposure management company that is looking for a Lead Threat Researcher / Threat Hunter to track adversary activity, analyze vulnerabilities and exploits, and turn findings into actionable intelligence and detections for their platform and customers.

This position offers hybrid setup with the flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas.

• Research emerging threats, threat actors (APT, ransomware groups) and their TTPs, mapped to MITRE ATT&CK
• Analyze newly disclosed CVEs, assess exploitability and weaponization status, and prioritize by real-world risk (KEV, EPSS, exploit availability)
• Run hypothesis-driven threat hunts across endpoint, network and cloud telemetry
• Build and tune detection content (Sigma, YARA, Snort/Suricata, SIEM queries)
• Reverse engineer malware samples and exploit code (static and dynamic) to extract IOCs and behaviors
• Monitor OSINT, dark web and underground sources for threat signals
• Write intelligence reports, advisories and blog posts for technical and executive audiences
• Contribute research data and logic to the client's intelligence platform and AI/automation workflows

• 5+ years of experience in threat intelligence, threat hunting, SOC/IR or security research
• Knowledge of MITRE ATT&CK, Cyber Kill Chain and Diamond Model
• Hands-on expertise in vulnerability analysis: CVE/CVSS/CWE, EPSS, CISA KEV, including exploit validation
• Background in detection engineering with Sigma, YARA and Snort/Suricata
• Proficiency in SIEM querying (Splunk SPL, KQL or Elastic)
• Understanding of malware analysis fundamentals using IDA/Ghidra, sandboxes and x64dbg
• Skills in scripting for automation and data analysis with Python
• Familiarity with threat intel platforms and standards (MISP, OpenCTI, STIX/TAXII)
• Strong technical writing skills in English (B2+ level)

Nice to have

• Published research, CVE credits or conference talks
• Experience in reverse engineering of exploits/PoCs and exploit development
• Competency in EDR/XDR hunting (CrowdStrike, SentinelOne, Defender)
• Expertise in cloud threat hunting across AWS, Azure and GCP logs
• Flexibility to use LLMs for threat research automation
• Certifications: GCTI, GCIH, GREM, GCFA, OSCP or CTIA

• Engineering Heritage: Best-in-class experts sharing a culture of engineering excellence and tackling complex engineering challenges for over 30 years
• Advanced Tech Stack: Innovative projects where you can apply or enhance your expertise in Cloud, Data, AI, and other emerging technologies
• World-Class Clients: Work closely with 340+ of the Forbes Global 2000 on creating disruptive solutions that make a global impact
• Professional Growth: Exceptional support for career development with comprehensive resources for upskilling or reskilling in pioneering practices
• GenAI Community: Strong AI competencies with 600+ experts across 55+ locations driving GenAI-enabled transformation journeys
• Entrepreneurial Culture: If you're passionate and dedicated to improving business transformation, we provide the support you need to bring your ideas to life
• Hybrid Setup: The flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas
• Other Benefits: Additional vacation and trust days, private health insurance, Employee Stock Purchase Plan and more