Lead, Threat Hunter

Flock Safety is the leading safety technology platform, helping communities thrive by taking a proactive approach to crime prevention and security. Our hardware and software suite connects cities, law enforcement, businesses, schools, and neighborhoods in a nationwide public-private safety network. Trusted by over 5,000 communities, 4,500 law enforcement agencies, and 1,000 businesses, Flock delivers real-time intelligence while prioritizing privacy and responsible innovation.

We’re a high-performance, low-ego team driven by urgency, collaboration, and bold thinking. Working at Flock means tackling big challenges, moving fast, and continuously improving. It’s intense but deeply rewarding for those who want to make an impact.

With nearly $700M in venture funding and a $7.5B valuation, we’re scaling intentionally and seeking top talent to help build the impossible. If you value teamwork, ownership, and solving tough problems, Flock could be the place for you.

The Opportunity

We are looking for a Lead, Threat Hunter. As someone with over 10 years of cybersecurity experience, at least 5 of those years in the trenches focused on DFIR/Threat Hunts, you will focus on defining and maturing the Adversary Pursuit program. As the function’s analytic lead, you will direct and manage threat hunts, technical table top exercise development, and tactical threat intelligence. You’ll identify and prioritize opportunities for improvement based on findings from these areas. You’ll work closely with our Offensive Security team to ensure a high level of efficacy in our ability to detect threats, and assist the Security Operations team with improvements to our response capabilities.

This is a critical role that will be responsible for developing new methods to search and detect threats across a rapidly scaling, high-value public-private safety network. You will be responsible for defining and executing hunts, determining and prioritizing visibility and detection gaps, and when necessary, assisting with response operations across thousands of deployed hardware devices, extensive cloud infrastructure, and core business applications. You will help with the creation of technical exercises against Flock’s full technology stack (hardware, software, cloud, network) to help increase preparedness and readiness. This role reports to the Director, Incident Response and Adversary Pursuit.

Success in this role will be measured by the development and execution of our threat hunt capabilities, ability and effectiveness to detect prioritized threats, and improved readiness to respond (through metrics such as MTTD).

The Skillset

• Leadership & Management:

  • Mold the long-term threat hunting roadmap, including strategy, data ingestion requirements, and coverage metrics.

  • Provide operational oversight during threat hunts, ensuring objectives are defined, hunt methodology is established and timeframes are met.

  • Mentor and guide junior analysts in hunting methodologies, query optimization, and forensic analysis.

• Technical Expertise:

  • Deep technical expertise in performing DFIR and adversary threat hunts, across diverse environments (corporate systems, cloud - AWS/GCP/Azure, and operational technology networks).

  • Strong experience performing DFIR on Android IoT devices.

  • Extensive experience utilizing enterprise security tooling (SIEM, EDR, etc.) as well as developing proprietary tools/scripts to scale the team’s capabilities.

  • Experience utilizing sandboxing technology to aid in the analysis of suspicious binaries and scripts; hands-on reverse engineering experience a plus.

  • Map findings to the MITRE ATT&CK framework to identify coverage gaps and improve detection posture.

  • Well versed in using cyber threat intelligence to update requirements, prioritize collection sources and integrate technical TTPs to inform and prioritize hunts.

  • Create and tune high-fidelity detection rules (e.g., Splunk SPL, YARA, Sigma) based on hunt findings to prevent future recurrence.

  • Assist with the development of technical table top exercises, ensuring scenario applicability to the organization’s risk profile and align to real world cyber events.

• Operational & Collaboration Skills:

  • Collaborate with Cybersecurity, Engineering, and Product teams to help plan, and execute threat hunts, providing detailed findings and data backed recommendations for cybersecurity and architectural improvements.

  • Work closely with the Offensive Security team to help perform regular testing and validation of custom detection rules.

  • Serve as a Tier 3 escalation point for SOC analysts; perform deep-dive root cause analysis on complex security incidents.

Feeling uneasy that you haven’t ticked every box? That’s okay; we’ve felt that way too. Studies have shown women and minorities are less likely to apply unless they meet all qualifications. We encourage you to break the status quo and apply to roles that would make you excited to come to work every day.

90 Days at Flock

We prescribe to 90 day plans and believe that good days lead to good weeks, which lead to good months. This serves as a preview of the 90 day plan you will receive if you were to be hired in this role at Flock Safety.

The First 30 Days

• Build a deep understanding of the company’s technology stack, threat landscape, and existing security operations and response practices

• Establish strong partnerships with Engineering, Infrastructure, Product Security, and Offensive Security teams

The First 60 Days

• Define a clear vision and strategy for Adversary Pursuit aligned to risk tolerance and business priorities to help create a cyber threat profile

• Evaluate current visibility (logs and intelligence) and detection capabilities to identify gaps and quick wins

90 Days & Beyond

• Build an organizational Cyber Threat Profile with prioritized threat actors and intelligence collection requirements and proactively identifying attacker TTPs

• Develop a phased roadmap to mature Adversary Pursuit capabilities, including visibility and detection gap remediations and tooling improvements as well as plans for incorporation into regular exercises

Salary & Equity

In this role, you’ll receive a starting salary between $150,000 and $190,000 as well as Flock Safety Stock Options. Base salary is determined by job-related experience, education/training, as well as market indicators. Your recruiter will discuss this in-depth with you during our first chat.

Location

We’re building the impossible, together. To drive innovation through in-person collaboration, we’re prioritizing candidates in our key hubs: Atlanta, Boston, Chicago, Denver, Los Angeles, New York City, San Francisco, and Austin. While we value the energy of our hub communities, we embrace remote work and welcome applications from exceptional talent across the United States.

The Perks

🌴Flexible PTO: We offer non-accrual PTO, plus 11 company holidays.

⚕️Fully-paid health benefits plan for employees: including Medical, Dental, and Vision and an HSA match.

👪Family Leave: All employees receive 12 weeks of 100% paid parental leave. Birthing parents are eligible for an additional 6-8 weeks of physical recovery time.

🍼Fertility & Family Benefits: We have partnered with Maven, a complete digital health benefit for starting and raising a family. Flock will provide a $50,000-lifetime maximum benefit related to eligible adoption, surrogacy, or fertility expenses.

🧠Spring Health: Spring Health offers a variety of mental health benefits, including therapy, coaching, medication management, and digital tools, all tailored to each individual's needs.

💖Caregiver Support: We have partnered with Cariloop to provide our employees with caregiver support

💸Carta Tax Advisor: Employees receive 1:1 sessions with Equity Tax Advisors who can address individual grants, model tax scenarios, and answer general questions.

💚ERGs: We want all employees to thrive and feel like they belong at Flock. We offer four ERGs today - Women of Flock, Flock Proud, LEOs and Melanin Motion. If you are interested in talking to a representative from one of these, please let your recruiter know.

💻WFH Stipend: $150 per month to cover the costs of working from home.

📚Productivity Stipend: $300 per year to use on Audible, Calm, Masterclass, Duolingo and so much more.

🏠Home Office Stipend: A one-time $750 to help you create your dream office.

If an offer is extended and accepted, this position requires the ability to obtain and maintain Criminal Justice Information Services (CJIS) certification as a condition of employment. Applicants must meet all FBI CJIS Security Policy requirements, including a fingerprint-based background check.

Flock is an equal opportunity employer. We celebrate diverse backgrounds and thoughts and welcome everyone to apply for employment with us. We are committed to fostering an environment that is inclusive, transparent, and collaborative. Mutual respect is central to how Flock operates, and we believe the best solutions come from diverse perspectives, experiences, and skills. We embrace our differences and know that we are stronger working together.

If you need assistance or an accommodation due to a disability, please email us at [email protected]. This information will be treated as confidential and used only to determine an appropriate accommodation for the interview process.

At Flock Safety, we compensate our employees fairly for their work. Base salary is determined by job-related experience, education/training, as well as market indicators. The range above is representative of base salary only and does not include equity, sales bonus plans (when applicable) and benefits. This range may be modified in the future. This job posting may span more than one career level.

Flock Safety is aware of fraudulent individuals and agencies falsely claiming to represent our company. All legitimate communication from Flock Safety will come from an email address ending in @flocksafety.com. We do not make job offers through messaging apps, social platforms, or unauthorized third parties, and we will never request payment or sensitive personal information during the hiring process. If you encounter suspicious outreach related to a Flock Safety role, please report it to [email protected]