Proactively hunts for threats and adversaries that automated detection misses.
Entry
Senior
Coding
High
Key skills
Career overview
The Threat Hunter assumes the attacker is already inside and goes looking for them: hypothesis-driven hunts across endpoints, logs and network telemetry, turning findings into new detections. The role mixes deep technical knowledge, attacker mindset and analytical rigour, and leads to senior security engineering or architecture.
Main responsibilities
- Hunt for threats proactively across the estate
- Analyse security alerts from the SIEM
- Produce and consume threat intelligence
- Perform digital forensics and evidence collection
- Analyse malware and reverse-engineer samples
- Lead security incident response and forensics
- Write and improve operational runbooks
- Mentor junior team members and review their work
- Keep technical documentation up to date
- Monitor platform health, alerts and dashboards
- Analyse application logs to identify root causes
- Operate security tools and the SOC platform
Technical skills
Technologies
Education level
Education requirements vary depending on the company, country and experience. Professional experience, certifications and technical skills can sometimes compensate for formal education.
High School / Bac
Less common
Bac+2 (2-year degree)
Less common
Bac+3 (Bachelor)
Less common
Bac+5 (Master / Engineering)
Common entry point
Experience & coding level
Experience level
Coding level
Useful certifications
Certifications are never mandatory. They are one way among others to prove a skill.
- GIAC GCFA
- GIAC GCTI
- Blue Team Level 2
- MITRE ATT&CK Defender
Where can this career take you?
Multiple paths are possible. Click a role to open its profile.
Direct progression
Possible branches
Where can you go next?
Realistic next career moves, with compatibility and a transition roadmap for each.
Overlap: 38% · Difficulty: Easy
Skills to learn: OSINT, IOC management, Adversary tracking
View roadmapOverlap: 50% · Difficulty: Hard
Skills to learn: Security architecture, Cloud security, IAM & PAM
View roadmapOverlap: 25% · Difficulty: Hard
Skills to learn: Security architecture, Cloud security architecture, IAM architecture
View roadmapWhere can you go from here?
A typical progression built from real career relationships. Click any role to open its profile.
Soft skills
- Technical curiosity
- Analytical thinking
- Rigour and attention to detail
- Autonomy
- Staying calm under pressure
- Problem solving
- Documentation writing
Common previous careers
Roles that frequently lead into this career.
Overlap: 58% · Difficulty: Hard
Skills to learn: Endpoint & log analysis, Malware analysis, Hypothesis design
View roadmapOverlap: 35% · Difficulty: Medium
Skills to learn: Endpoint & log analysis, Malware analysis, Detection engineering
View roadmapRelated resources
Continue your career exploration
Keep moving: compare roles, follow a roadmap, read a guide or prepare for an interview.
Ready to explore your next step?
A documented transition from this role to the next.
Threat HunterThreat Intelligence Analyst
Keep exploring
Compare this role with others, or check which career fits you best.