Cybersecurity Analyst - Threat Hunter

Location: Hybrid, Juarez Nuevo León Opportunity Kohler Co. is seeking a SOC Analyst / Threat Hunter to strengthen detection, investigation, and response capability across the enterprise. This is a hands-on, operationally focused role. You will go beyond alert triage to investigate real threats, perform proactive hunting, and directly improve how the SOC detects and responds. You will work closely with cybersecurity architecture, engineering, and platform teams, with real influence on visibility, detection quality, and operational outcomes. The role is well-suited to someone who is technically curious, thinks like an attacker, and wants meaningful work rather than ticket throughput. You will investigate threats that include automation and AI-assisted attack techniques and will work with analytics and AI-supported capabilities within security tooling, part of a deliberate move toward a more intelligent, agentic security operations model. This role operates within standard business hours with an on-call rotation. Key Responsibilities Detection Incident Response Monitor, triage, and investigate security alerts across endpoint, identity, network, cloud, and SaaS environments—moving quickly from initial signal to understanding scope and impact. Lead and support incident investigations by developing clear timelines, identifying affected assets, and driving toward containment. Execute and oversee containment and response actions (including via automated and agentic workflows) in line with established playbooks, using sound judgment when situations fall outside defined procedures. Produce clear, concise documentation of investigations and incidents to support post-incident review and continuous improvement. Threat Hunting Perform proactive, hypothesis-driven threat hunting based on attacker techniques, observed behavior, and current threat intelligence. Develop and test hunt hypotheses mapped to MITRE ATT CK (or equivalent frameworks), translating them into structured queries and analysis. Identify weak signals and suspicious patterns that fall below existing detection thresholds. Feed hunt findings back into detection engineering—improving rule quality and closing visibility gaps over time. Detection Signal Improvement Assist with tuning and improving SIEM and EDR detections. Reduce false positives while strengthening high-confidence alerts. Work with architecture and engineering teams to improve telemetry and visibility. Attacker TTP Awareness Actively follow the evolving threat landscape, including emerging attacker tooling, techniques, and campaigns, and bring relevant intelligence into day-to-day detection and hunting activity Map detections and hunts to real-world attack behavior. Proactively identify and prioritize detection gaps based on current threat actor behavior. Operational Maturity Contribute to the development and refinement of SOC procedures and playbooks. Contribute to automation and orchestration efforts to improve response speed and consistency. Provide operational feedback to improve security architecture and tooling decisions.