Enter a job title or keyword

Job Posting CYBER THREAT HUNTING MANAGER

JTI

Job Location:

Madrid - Spain

Monthly Salary: Not provided by the employer

Posted: 27 May 2026 (30+ days ago)

Application Deadline: 24 August 2026

Vacancies: 1 Vacancy

The job posting is outdated and position may be filled

Job Summary

At JTI we celebrate differences and everyone truly belongs. 46000 people from all over the world are continuously building their unique success story with us. 83% of employees feel happy working at JTI.

To make a difference with us all you need to do is bring your human best.

What will your story be Apply now!

Learn more:

Department: Cyber Security

Location: Madrid Spain

CYBERTHREAT HUNTING MANAGER

The Threat Hunting Manager is responsible for ensuring JTI has a strong proactive threat detection and threat hunting capability across both onpremise and cloud environments.

The role is accountable for the effectiveness of detection and hunting outcomes achieved by orchestrating a managed security service provider (MSSP) and a small internal technical team as a single highperforming function.

This position focuses exclusively on Threat Detection and Threat Hunting. While it does not own Incident Response Cyber Threat Intelligence or Vulnerability Management the role works closely with these teams to provide early detection insights validate scope and identify malicious activity as early as possible.

The primary objective is to continuously improve JTIs ability to detect advanced threats early reduce attacker dwell time and scale detection and hunting services enterprisewide. This includes governance of MSSP performance technical leadership of the internal team and close alignment with IT and business stakeholders to ensure detection capabilities reflect JTIs risk landscape and business priorities.

Responsibilities:

Provide technical leadership strategic vision and endtoend accountability for the organisations threat detection and threat hunting capability. This includes orchestrating the Managed Security Service Provider (MSSP) and the internal technical team as a cohesive operating model ensuring clear accountability effective technical execution and continuous improvement of detection and hunting outcomes across onpremise and cloud environments
Accountable for the effectiveness and quality of the organisations threat detection capability delivered through both the Managed Security Service Provider (MSSP) and the internal technical team. This includes assessing detection coverage determining the need for new analytic rules designing and creating detections from scratch where required and ensuring existing rules are continuously reviewed optimised and maintained to deliver highfidelity detections reduce noise and ensure consistent detection standards and outcomes across all detection providers
Accountable for the effectiveness and coordination of the organisations threat hunting capability delivered through both the Managed Security Service Provider (MSSP) and the internal technical team. This includes aligning and supervising MSSPled hunting activities ensuring hunts are relevant timely and riskdriven while guiding and supporting the internal team in performing advanced hypothesisbased threat hunting to identify sophisticated or previously undetected threats and ensuring consistent hunting standards and outcomes across both delivery models
Accountable for integrating purple team activities into the threat detection and hunting lifecycle. This includes translating adversary simulations attack scenarios and identified gaps into actionable detection improvements ensuring learnings from offensive testing directly enhance analytic rules hunting hypotheses and overall detection effectiveness
Accountable for effective collaboration across Incident Response Cyber Threat Intelligence Vulnerability Management and other security functions to ensure threat detection and hunting activities are aligned with broader security operations. This includes sharing context and insights supporting investigation and scoping informing prioritisation and ensuring detection and hunting outputs meaningfully contribute to response remediation and risk reduction efforts

Who we are looking for:

Education & Experience:

Degree in Computer Science Cybersecurity or a related field (or equivalent experience)
57 years of experience in security monitoring alert triage and threat hunting
Hands-on experience with SIEM XDR and other security platforms
Experience supporting large global organizations in hybrid environments
Background in incident response threat intelligence or related security operations

Skills & Competencies:

Strong analytical and problem-solving skills
Ability to interpret complex security signals and drive clear outcomes
Experience with change management and continuous improvement
Excellent communication and presentation skills
Strong ownership accountability and sense of urgency
Knowledge of frameworks such as MITRE ATT&CK Cyber Kill Chain and Diamond Model
Experience with EDR identity protection network and cloud security technologies
Understanding of threat actors and their tactics techniques and objectives
Innovative curious and solution-oriented mindset
Customer service-oriented attitude

Are you ready to join us Build your success story at JTI. Apply now!

Next Steps:

After applying if selected please anticipate the following within 1-3 weeks of the job posting closure: Phone screening with Talent Advisor > Assessment tests > Interviews > Offer. Each step is eliminatory and may vary by role type.

At JTI we strive to create a diverse and inclusive work environment. As an equal-opportunity employer we welcome applicants from all backgrounds. If you need any specific support alternative formats or have other access requirements please let us know.

Required Experience:

Manager

Apply Now