Cyber Threat Hunter

• 401(k)
• Competitive salary
• Dental insurance
• Health insurance
• Paid time off
• Training & development
• Vision insurance

• Support two to four active client matters at a time, with priorities that can shift within the hour
• Proactively hunt across client environments to identify every compromised system and account
• Write and tune detection rules and hunting queries during active incidents
• Drive and recommend containment actions in coordination with the engagement lead
• Keep contemporaneous, factual notes and produce clear timelines and findings suitable for review by clients, counsel, and insurers
• Brief engagement leads, and when requested, clients and counsel

• Validate and tune EDR deployments in new environments, including policy configuration and sensor health review
• Hunt for credential dumping, remote access tool abuse, living off the land binaries, lateral movement, and persistence
• Execute host isolation, process termination, file quarantine, and account disablement
• Collect forensic artifacts remotely using EDR live response capabilities

• Identify, collect, and preserve cloud logs at engagement start and flag logging gaps
• Hunt for identity-based attacks such as token theft, AiTM and device code phishing, MFA fatigue, malicious OAuth grants, and service principal or IAM role abuse
• Trace attacker activity across control plane and data plane logs to establish what was created, changed, accessed, or exfiltrated
• Support containment such as key rotation, session revocation, Conditional Access changes, and removal of attacker persistence

• 5+ years in cybersecurity, including at least 3 years of hands-on incident response or threat hunting on real intrusions
• 2+ years of detection engineering: writing, testing, and tuning detections in production
• Direct experience on ransomware or cloud compromise investigations, ideally in a commercial or multi-tenant setting
• Endpoint focus: Proficient in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third
• Cloud focus: Proficient in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, with working knowledge of at least one of the EDR platforms above
• Production-quality hunting queries in KQL plus at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable reading Splunk SPL
• Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK
• Scripting in PowerShell and Python
• Solid forensic fundamentals: Windows artifacts (event logs, registry, Prefetch, Amcache, Shimcache, SRUM, $MFT, USN journal), Linux and macOS logs and persistence, triage tools such as KAPE or Velociraptor, the Eric Zimmerman tools, timelining, and basic memory analysis with Volatility or similar
• Knowledge of current ransomware tactics, common initial access vectors, and exfiltration tools such as Rclone, MEGAsync, and Restic
• Understanding of chain of custody and evidence handling that will withstand legal scrutiny
• Strong written English and the ability to brief non-technical stakeholders
• Availability for the full period of performance, including participation in potential on-call rotation covering nights, weekends, and holidays
• Must be a U.S. citizen and reside in the United States
• Must have a commercial background check completed within the last 6 months, or be willing to complete one prior to start

• Experience with Microsoft Sentinel, Defender XDR, CloudTrail Lake, Athena, GuardDuty, or the Microsoft 365 Unified Audit Log
• Familiarity with cloud forensic tools such as Microsoft Extractor Suite, Hawk, CISA Untitled Goose Tool, or Invictus tooling
• Experience with additional EDR platforms (Carbon Black, Cortex XDR, Elastic Defend, Sophos)
• Detection validation using Atomic Red Team or comparable tooling
• Google Cloud or Google Workspace experience
• Certifications such as GCFA, GCIH, GCFE, GREM, GCTI, GCFR, AWS Certified Security Specialty, AZ-500, CCFH, CCFR, SC-200, SentinelOne certifications, CySA+, or offensive security certifications

• Fully remote with standard business-hours coverage in your time zone, plus potential on-call rotation
• Accounts, tools, and equipment provided as needed
• Strict confidentiality and client data separation required

Our Philosophy