Threat Hunter Interview Questions UK: 8 Real Questions and What Interviewers Want

Applying for a Threat Hunter job in the UK? Here is what you are likely to be asked. These questions come from our Threat Hunter question bank of 12 questions, written for UK employers at senior level.

Eight Threat Hunter interview questions, and what the interviewer is thinking

1. Walk me through how you plan and run a hypothesis-driven hunt from start to finish.

Why they ask: They want to see a structured, repeatable hunting method.

2. How would you hunt for command-and-control beaconing in network or proxy data?

Why they ask: They want a practical, technical hunting example.

3. How do you hunt for credential theft and lateral movement in an Active Directory environment?

Why they ask: They want to see understanding of identity-based attack techniques.

4. What data sources do you rely on most for hunting, and what do you do when the data you need isn't available?

Why they ask: They want to see data awareness and pragmatic problem-solving.

5. How do you distinguish between malicious behaviour and legitimate administrator activity when hunting?

Why they ask: They want to test your judgement about context, baselines and false positives.

6. During a hunt you find what appears to be a persistence mechanism on a single server. What are your next steps?

Why they ask: They want to see how you shift from hunting into incident handling without tipping off an attacker.

7. Tell me about a hunt you carried out that uncovered a genuine threat or significant gap.

Why they ask: They want concrete evidence of hunting impact.

8. Why threat hunting, and what qualities make a good threat hunter?

Why they ask: They want to understand motivation and self-awareness for a proactive, ambiguous role.

A sample answer to question 1

Walk me through how you plan and run a hypothesis-driven hunt from start to finish.

I begin with a hypothesis grounded in something concrete: a threat intelligence report, a recent incident, a gap found in a purple team exercise or a technique relevant to our sector. For example, 'an attacker with valid credentials is using remote services to move laterally between workstations'. I define the ATT&CK techniques involved, identify what data would show it, such as authentication logs, process creation and network flows, and check data quality before I start. Then I explore: filtering, stacking and baselining normal behaviour, looking for outliers like rare parent-child process pairs, unusual logon types or a host contacting many peers. I pivot on interesting results and validate by gathering context from the user, the asset owner and other telemetry. If I find malicious activity, I hand over to incident response with evidence. Whatever the outcome, I document the hunt in a framework such as PEAK or TaHiTI, including queries, data gaps and conclusions, and convert reliable logic into a detection so the SOC benefits permanently.

Common mistake to avoid: Browsing logs without a hypothesis; Failing to record findings or gaps

Want the rest?

Full model answers, key points and common mistakes for all 12 questions are on the Threat Hunter interview questions page. The first five are free, no sign-up needed.