Piper Companies is seeking a Threat Hunting Investigator for a leading technology organization. The Threat Hunting Investigator is a Remote position operating on EST business hours. An ideal candidate for the Threat Hunting Investigator is a senior cybersecurity professional with deep experience in insider threat investigations, advanced Splunk detection engineering, and hands-on expertise developing SPL queries, Risk-Based Alerting (RBA), and User and Entity Behavior Analytics (UEBA) solutions. Responsibilities of the Threat Hunting Investigator: • Conduct proactive threat hunting and investigations focused on insider threats, suspicious user activity, and protection of critical intellectual property. • Develop, test, deploy, and tune advanced Splunk detection content using SPL, correlation searches, risk rules, and notable events. • Configure and optimize RBA and UEBA workflows to identify high-risk behaviors and improve threat detection capabilities. • Produce clear investigative reports, technical documentation, and actionable recommendations for security stakeholders. Qualifications of the Threat Hunting Investigator: • 5+ years of experience conducting digital threat investigations, insider threat analysis, and forensic investigations. • Advanced hands-on experience with Splunk Enterprise Security, including authoring complex SPL queries from scratch. • Strong experience developing and managing Risk-Based Alerting (RBA) and User and Entity Behavior Analytics (UEBA) programs. • Proven ability to translate threat intelligence and MITRE ATT&CK techniques into production-ready detections and security workflows. Compensation for the Threat Hunting Investigator includes: • Comprehensive benefits package including medical, dental, vision, 401(k), sick leave as required by law, and PTO. • Fully remote work environment with EST business hours. • Opportunity to support enterprise-level insider threat investigations within a globally recognized technology environment. This job opens for applications on 10/30/2026. Applications for this job will be accepted for at least 30 days from the posting date. #LI-MM9 #LI-REMOTE