Cyber Threat Hunter

This is a Fully Remote Job

About Our Client:

The organization operates in the cybersecurity industry, focusing on digital forensics and incident response to address threats such as ransomware, extortion, and cloud account compromises. It handles rapid, high-stakes investigations that often involve legal counsel, requiring precise and factual documentation. The program supports clients across diverse environments including cloud platforms like AWS and Azure, emphasizing the containment and thorough investigation of security incidents.

About the Opportunity:

The CYBER THREAT HUNTER role is designed to identify, investigate, and contain cyber intrusions rapidly and effectively. This position is critical in uncovering compromised systems and accounts through proactive threat hunting, contributing to the organization's ability to respond decisively during active incidents. The role supports clients by delivering clear, factual findings and recommendations that directly impact incident outcomes.

Responsibilities:

• Manage two to four active client investigations simultaneously, adapting to shifting priorities
• Proactively hunt for threats across client environments to identify compromised assets
• Develop and refine detection rules and hunting queries during incidents
• Recommend and coordinate containment strategies with engagement leads
• Maintain accurate, factual documentation and timelines suitable for review by clients, legal counsel, and insurers
• Provide briefings to engagement leads and, when requested, to clients and counsel
• For Endpoint Threat Hunters: Validate and tune endpoint detection and response (EDR) deployments, hunt for credential misuse and persistence mechanisms, execute containment actions, and collect forensic artifacts remotely
• For Cloud Threat Hunters: Preserve cloud logs, detect identity-based attacks, trace attacker activities across cloud environments, and support containment measures such as key rotation and session revocation

Requirements:

• Minimum 5 years in cybersecurity, including 3 years of hands-on incident response or threat hunting
• At least 2 years of detection engineering experience with writing and tuning detections
• Direct experience with ransomware or cloud compromise investigations
• Endpoint focus: Proficiency in at least two of CrowdStrike Falcon, SentinelOne Singularity, Microsoft Defender for Endpoint; working knowledge of the third
• Cloud focus: Proficiency in AWS, Azure/Entra ID/Microsoft 365, or GCP log investigation; working knowledge of at least one major EDR platform
• Skilled in KQL and at least one other query language such as CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable with Splunk SPL
• Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK
• Scripting skills in PowerShell and Python
• Strong forensic knowledge across Windows, Linux, and macOS artifacts and memory analysis
• Understanding of ransomware tactics, initial access methods, and exfiltration tools
• Knowledge of legal standards for chain of custody and evidence handling
• Strong written communication and ability to brief non-technical stakeholders
• Availability for full engagement periods including possible on-call rotations
• U.S. citizenship and residence
• Recent commercial background check or willingness to complete one prior to start

Pay Range and Compensation Package:

• The pay range and compensation package for this role will be determined based on the candidate's experience, skills, and other relevant factors.

Benefits & Perks:

• 401(k)
• Dental insurance
• Health insurance
• Paid time off
• Training and development
• Vision insurance

Equal Opportunity Statement: Our client is an equal opportunity employer. They celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, or national origin.

Note:

TalentHop is a recruitment partner of this role. Please note that all employment decisions, including candidate assessment, interviews, hiring, compensation, and employment terms, are made exclusively by the hiring employer.