Incident Response Threat Hunter

Incident Response Threat Hunter (Mid to Senior) | Remote, UK

When an organisation has been breached, you’ll be the one working out how the attacker got in, where they went and what they left behind. You’ll hunt across compromised environments alongside incident response analysts on live forensic investigations, helping organisations recover from ransomware, data theft and full network compromise.

Incident Response Threat Hunter - The essentials

• £60,000 to £85,000, depending on experience
• Fully remote, UK based
• Mid to senior level, joining a consultancy’s threat detection and response team

Incident Response Threat Hunter - What you’ll actually do

• Run threat hunts across client environments during active incident response engagements
• Use EDR platforms including CrowdStrike, SentinelOne, Carbon Black and Microsoft Defender for Endpoint to find indicators of compromise
• Work out how attackers got around existing security controls, and map their activity to MITRE ATT&CK
• Identify anomalous behaviour across endpoints and network traffic on Windows, UNIX and macOS
• Research threat actors, vulnerabilities and attack infrastructure using internal and external intelligence
• Share your findings with the incident response analysts leading each investigation

Incident Response Threat Hunter - What you’ll need

Essential

• Hands-on experience with at least one major EDR platform
• A background in threat hunting, incident response, cyber threat intelligence or security operations
• Experience in network or host-based intrusion analysis, digital forensics or malware handling
• Working knowledge of MITRE ATT&CK and attacker tactics, techniques and procedures (TTPs)
• Confidence investigating across Windows, UNIX and macOS
• The ability to think like an attacker when piecing together how a breach happened

Nice to have

• Host or network forensics from a malware perspective
• Certifications such as GCFA, GNFA, GREM, OSCP or OSCE
• Knowledge of network protocols, routing and common internet standards
• Understanding of regulatory and compliance requirements

What’s in it for you

Real incidents, not simulations. You’ll build deep EDR and hunting experience on live investigations, working fully remotely from anywhere in the UK.

If you meet most but not all of the essentials, we’d still like to hear from you. If you need any adjustments during the application process, tell us and we’ll make them.

Apply

LT Harper is handling this search on our client’s behalf. If you’re interested, apply directly on this advert. If you have any questions, or would like to refer someone, reach out to Adam Sawa at a.sawa@ltharper.com.