Skillenai

Threat hunting jobs in 2026 — demand, top roles hiring, and related skills

As of 2026-09-30, Threat hunting appears in 779 job postings indexed by Skillenai over the past 90 days — Security Engineer has the most postings mentioning Threat hunting, with demand share up 22.1% vs the prior 4 weeks.

Last updated · 90d ending 2026-09-30

Postings · last 90 days
779
Demand vs prior month
up 22.1% vs the prior 4 weeks
Top role · 20.7% of skill postings
Security Engineer
Top hiring metro
New York City

Which roles want Threat hunting?

Upload your resume and Skillenai will show which roles your Threat hunting experience fits, which skills you already cover, and what is missing.

See which roles your Threat hunting experience fits →No account needed.

Prepare to discuss Threat hunting in your interview

We’re building mock interviews informed by job postings and career profiles, to help you explain how you’ve used Threat hunting.

Join the mock interview waitlist →AI or human interviews. Coming soon.

Frequently asked questions about Threat hunting

+Is Threat hunting in demand in 2026?

Yes. Threat hunting appears in 779 job postings indexed by Skillenai over the 90 days ending 2026-09-30. Security Engineer accounts for the most postings mentioning Threat hunting (20.7% of all postings mentioning Threat hunting).

+What jobs require Threat hunting?

According to the Skillenai jobs index over the 90 days ending 2026-09-30, among roles with at least 20 postings, the highest shares mentioning Threat hunting are Security Operations Analyst (61.9% of that role’s postings mention Threat hunting), Detection Engineer (46.4% of that role’s postings mention Threat hunting), SOC Analyst (34.6% of that role’s postings mention Threat hunting).

+What skills are commonly paired with Threat hunting?

Across job postings indexed by Skillenai (90 days ending 2026-09-30), Threat hunting most often appears alongside incident response, SIEM, threat intelligence, Python, EDR.

+Where is Threat hunting most in demand?

As of 2026-09-30, the metro areas posting the most jobs requiring Threat hunting are New York City, Bengaluru, Boston, Austin, Pune, according to the Skillenai jobs index.

+How can I keep up with new Threat hunting content and jobs?

Skillenai indexes news, blog posts, and research papers mentioning Threat hunting alongside the jobs index. You can subscribe to a daily email digest of new Threat hunting content from your Skillenai account.

+Which skills come before and after Threat hunting?

The skill-flow chart shows skills documented in adjacent positions across observed employer changes. An outgoing skill is documented in the following position but not the preceding one. These are ideas to explore, not proven prerequisites, acquisition dates, or levels of mastery. Each ribbon counts employer moves with that skill pair; one move can contribute several pairs.

Weekly indexed postings requiring Threat hunting — last 90 days

Salary distribution

Box = 25th–75th percentile · tick = median · whisker = 10th–90th · USD, annualized

Career paths around Threat hunting

Skills documented before and after this skill across employer changes.

Historical career profiles · all locations

Skills before Threat hunting

Before Threat huntingincident response → Threat hunting: 4 observed employer moves with this skill pairVulnerability Management → Threat hunting: 3 observed employer moves with this skill pairVulnerability assessments → Threat hunting: 3 observed employer moves with this skill pairAzure → Threat hunting: 3 observed employer moves with this skill pairSIEM → Threat hunting: 3 observed employer moves with this skill pairPenetration Testing → Threat hunting: 3 observed employer moves with this skill pairEndpoint Security → Threat hunting: 2 observed employer moves with this skill pairdigital forensics → Threat hunting: 2 observed employer moves with this skill pairThreathuntingincident response: 4 movesincident response4 movesVulnerability Management: 3 movesVulnerabilityManagement3 movesVulnerability assessments: 3 movesVulnerabilityassessments3 movesAzure: 3 movesAzure3 movesSIEM: 3 movesSIEM3 movesPenetration Testing: 3 movesPenetrationTesting3 movesEndpoint Security: 2 movesEndpoint Security2 movesdigital forensics: 2 movesdigital forensics2 moves

Skills after Threat hunting

After Threat huntingThreat hunting → Cloud Security: 2 observed employer moves with this skill pairThreat hunting → Java: 2 observed employer moves with this skill pairThreat hunting → Compliance: 2 observed employer moves with this skill pairThreat hunting → JavaScript: 2 observed employer moves with this skill pairThreat hunting → AWS: 2 observed employer moves with this skill pairThreat hunting → anomaly detection: 2 observed employer moves with this skill pairThreat hunting → multilingual products: 1 observed employer moves with this skill pairThreat hunting → credentials: 1 observed employer moves with this skill pairThreathuntingCloud Security: 2 movesCloud Security2 movesJava: 2 movesJava2 movesCompliance: 2 movesCompliance2 movesJavaScript: 2 movesJavaScript2 movesAWS: 2 movesAWS2 movesanomaly detection: 2 movesanomaly detection2 movesmultilingual products: 1 movesmultilingualproducts1 movescredentials: 1 movescredentials1 moves
How to read this chart · view counts

Each side is an independent set of observed employer moves, not the same people followed through three stages. Ribbon widths compare move counts within that side. Internal moves are not included.

The following position documents a skill that the preceding position does not. Skills must be linked to both positions, with clear dates and no overlap. One move can connect several skill pairs. These patterns suggest skills to explore; they do not establish prerequisites, when a skill was learned, or a higher skill level.

Source: Skillenai talent graph, historical career profiles. Historical descriptions and coverage can change. Only the leading published connections are shown.

Observed connections and move counts
ConnectionMoves
Before: incident response4
Before: Vulnerability Management3
Before: Vulnerability assessments3
Before: Azure3
Before: SIEM3
Before: Penetration Testing3
Before: Endpoint Security2
Before: digital forensics2
After: Cloud Security2
After: Java2
After: Compliance2
After: JavaScript2
After: AWS2
After: anomaly detection2
After: multilingual products1
After: credentials1

Roles most likely to require Threat hunting

Among roles with at least 20 postings in the same period.

RolePostings mentioning skill% of role postings mentioning skill
Security Operations Analyst1361.9%
Detection Engineer1346.4%
SOC Analyst934.6%
Security Solutions Architect522.7%
Security Operations Engineer1422.2%
Endpoint Security Engineer418.2%
Security Analyst4712.3%
Cyber Security Analyst2212.0%
Cybersecurity Advisor311.1%
Corporate Security Engineer210.0%

Roles with the most Threat hunting postings

RolePostings mentioning skillShare of skill postings
Security Engineer16120.7%
Security Analyst476.0%
Cybersecurity Analyst273.5%
Cybersecurity Engineer253.2%
Cyber Security Analyst222.8%
Information Security Analyst182.3%
Information Security Engineer182.3%
Software Engineer162.1%
Security Operations Engineer141.8%
Detection Engineer131.7%

Top companies posting jobs requiring Threat hunting

Employers ranked by indexed job postings in the last 90 days.

Top companies posting jobs requiring Threat hunting
CompanyPostings · 90 days
Stripe23
Google10
SentinelOne10
CrowdStrike10
Sophos9
Cisco9
Writer8
Klaviyo8
Anduril Industries8
Kyndryl7

Job postings indexed over the past 90 days, grouped by resolved employer. Counts are postings, not hires. Companies without a published page appear without a link.

Top metros hiring for Threat hunting

NamePostingsShare
New York City293.7%
Bengaluru243.1%
Boston172.2%
Austin162.1%
Pune162.1%
Seattle162.1%
Tel Aviv162.1%
San Francisco151.9%
Sydney141.8%

Skills commonly paired with Threat hunting

incident response (500)SIEM (417)threat intelligence (284)Python (280)EDR (228)Detection engineering (199)SOAR (179)MITRE ATT&CK (170)vulnerability management (132)log analysis (130)

Get a daily email digest of new Threat hunting content

Skillenai indexes news articles, blog posts, and research papers that mention Threat hunting. Click below and we'll open a pre-filled daily digest — change the cadence to hourly or weekly if you prefer, then save. Free account required (~30 seconds).

Get the Threat hunting content digest →Browse all skills →

Explore related pages

How this was computed

Counts derive from the Skillenai jobs index over the 90 days ending 2026-09-30. Skills are resolved against the Skillenai canonical taxonomy, so the same entity is counted whether a posting writes 'Python', 'Python 3', or 'python'. Role prevalence divides postings mentioning Threat hunting by all postings for each role in the same window, ranking roles with at least 20 postings. Role distribution divides each role’s Threat hunting postings by all Threat hunting postings, including postings without a role. Shares need not sum to 100% for the displayed roles. Pages refresh weekly (or daily for the top-50 most-requested skills). Adjusted posting share: 0.3% to 0.3%. Demand share change is the relative percentage change between these adjusted shares. Each employer-and-ATS group has at least 10 postings in each 90-day window; its earlier posting count supplies the same weight in both windows. The panel includes 2,596 identified employers and covers 68% of earlier and 72% of latest indexed postings. Windows: 2026-06-02 to 2026-08-31 and 2026-06-30 to 2026-09-28 (UTC; end dates excluded). The windows overlap by 62 days. Dates reflect indexing, not the employer’s posting date. This measures posting mix, not total hiring or market-wide demand. Matching excludes entrants and exits; changes in crawl completeness within an employer or ATS can still affect the result.

source
Skillenai jobs index, deduplicated daily
entity_id
9f009134b0694849
data_as_of
2026-09-30
window_days
90
Hiring engineers who use Threat hunting?

The demand, skills, and geo numbers on this page come from the same Skillenai labor market index that powers our API. Use it for compensation benchmarking, hiring-competition analysis, and skill-adoption tracking.

Skillenai for recruiters →
Compiled by Jared Rand · Data sourced from the Skillenai labor market index