What does a threat hunter do?
A threat hunter forms hypotheses, pulls and analyzes log data, confirms or refutes attacker activity, maps what they find to MITRE ATT&CK, escalates confirmed threats, and turns each finding into a detection rule so the SOC catches the same thing next time. That is the loop most days. A hunter usually starts from a question rather than an alert, something like "if a credential leaked six months ago, is there evidence someone used it for lateral movement?", and then spends hours in Sentinel, Splunk, EDR logs, and cloud telemetry trying to prove or kill that idea. Most of that time goes into the validation, not the idea itself.
What skills do you need to become a threat hunter?
Curiosity and an attacker mindset come first, the instinct to ask "what would I do if I were already inside, and where would that show up?" Everything else is learnable on top of that. You need ATT&CK and TTP fluency, comfort reading large volumes of log data, and at least one query language such as KQL or SPL. Operating-system and network internals matter, because you cannot spot the odd process or the strange outbound connection if you do not know what the normal ones look like. Knowing "normal" for a given environment is honestly half the job.
Mindset beats tooling here. A hunter with sharp instincts and average query skills usually outperforms the reverse. The real bottleneck for most teams isn't a shortage of good hypotheses, it's validation capacity. A single hypothesis can take hours to check by hand across several systems, so teams test three a week instead of thirty. That capacity gap is exactly what automation addresses, and it is why the "attacker mindset" skill matters more than the query-syntax skill going forward. The agent can write the query. It can't decide what's worth asking.
Is threat hunting a dedicated role or part of the SOC analyst job?
Both exist, and which one you see depends mostly on the size of the org. In larger enterprises threat hunting is often a dedicated senior role, a Tier 3 hunter or a small hunt team whose whole job is proactive investigation, separate from the alert queue. In most other places it is a hat that experienced SOC analysts, usually Tier 2 or Tier 3, put on when the alert queue lets them breathe, which is rarely. The queue almost always wins.
That "when they have time" problem is the real constraint, not head count or ideas. Hunting is the thing that gets dropped first when reactive work piles up, so it quietly becomes a periodic, secondary activity in teams that would genuinely benefit from doing it weekly. An AI Threat Hunt Agent gives that time back by taking the manual validation work off the SOC's desk, the agent runs the hypotheses in parallel across months of historical data, and the analyst reviews verdicts instead of writing queries. The role doesn't disappear either way. The hours it needs stop competing with the queue.