Cyber Incident Response Lead & Threat Hunter

Covenant HR LLC; United States; Remote; USD 110,000 - 165,000; Full time

Job summary

Covenant HR LLC is seeking a Cyber Incident Response Lead & Threat Hunter for a remote US-based contract (3-6 months with potential for contract-to-hire). You will serve as the senior technical lead during major cybersecurity incidents, coordinating response across engineering and security teams while guiding containment and recovery actions.

You will work hands-on with CrowdStrike Falcon and Real Time Response, develop advanced KQL or SPL queries, and conduct hypothesis-driven threat hunts

Qualifications

• Demonstrated experience leading technical teams during major cybersecurity incidents.
• Hands-on expertise with CrowdStrike Falcon for endpoint investigation, containment, and RTR.
• Advanced query skills in KQL or SPL with proficiency in the other.
• Experience performing threat hunts using MITRE ATT&CK and threat intelligence.
• Investigation across Windows, macOS, Linux, AD, Entra ID, and cloud environments.

Responsibilities

• Serve as the senior technical lead for complex cybersecurity incidents and guide the full incident lifecycle.
• Lead investigations to identify attack vectors, scope, containment, and eradication activities.
• Use CrowdStrike Falcon and RTR to investigate endpoints, collect evidence, and execute containment actions.
• Develop advanced KQL and SPL queries to identify anomalous activity and correlate events.
• Conduct hypothesis-driven threat hunts using MITRE ATT&CK and known adversary TTPs.
• Coordinate with security operations, engineering, and other teams to drive incident response and resolution.
• Communicate incident status, findings, and business impact to security leadership.
• Document findings, root causes, and lessons learned to improve future operations.

Skills

Incident leadership

CrowdStrike Falcon

KQL / SPL

MITRE ATT&CK

Threat hunting

Multi-OS support

Telemetry analysis

Tools

CrowdStrike RTR

Job description

Company

Our client is a leading cybersecurity consulting and technology services provider, helping organizations strengthen their security posture, respond to sophisticated cyber threats, and protect critical business operations. They offer the chance to tackle complex security challenges alongside highly skilled cybersecurity professionals.

Job Title

Cyber Incident Response Lead & Threat Hunter

Location

100% Remote (USA)

Role Type

Contract (3-6 months minimum), with option for Contract to Hire

Must Have Skills:

• Demonstrated experience serving as the technical lead during major cybersecurity incidents, directing investigation, scoping, containment, eradication, and recovery efforts while coordinating technical teams under pressure.
• Strong hands-on expertise with CrowdStrike Falcon, including endpoint investigation, threat hunting, containment, incident response, and Real Time Response (RTR).
• Advanced query development skills in either KQL (Microsoft Sentinel) or SPL (Splunk), with working proficiency in the other. Ability to investigate endpoint, identity, cloud, email, and network telemetry.
• Proven experience conducting hypothesis-driven threat hunts using MITRE ATT&CK, threat intelligence, and adversary behavior, translating findings into actionable detections and remediation recommendations.
• Hands-on investigation experience across Windows, macOS, Linux, Active Directory, Entra ID, and cloud environments (Azure, AWS, and/or Microsoft 365), with excellent verbal communication skills and the ability to engage technical teams and executive stakeholders.

Responsibilities and Job Details:

• Serve as the senior technical lead for complex cybersecurity incidents, guiding response teams through the complete incident lifecycle.
• Lead incident investigations to identify attack vectors, determine scope and impact, contain threats, and coordinate eradication and recovery activities.
• Leverage CrowdStrike Falcon and Real Time Response (RTR) to investigate compromised endpoints, collect evidence, and execute containment actions.
• Develop and execute advanced KQL and SPL queries to identify suspicious activity and correlate security events across multiple telemetry sources.
• Conduct proactive, hypothesis-driven threat hunts using MITRE ATT&CK, threat intelligence, and known adversary tactics, techniques, and procedures (TTPs).
• Investigate threats spanning Windows, macOS, Linux, Active Directory, Entra ID, Azure, AWS, and Microsoft 365 environments.
• Translate investigation and threat hunting findings into actionable detection improvements, security control enhancements, and remediation strategies.
• Coordinate with security operations, engineering, and other technical teams to drive effective incident response and resolution.
• Provide clear, timely communication to security leadership and executive stakeholders regarding incident status, findings, business impact, and recommended actions.
• Identify security visibility gaps and recommend improvements to monitoring, detection, and incident response capabilities.
• Document incident findings, root causes, response actions, and lessons learned to strengthen future security operations.
• Operate as a senior individual contributor, providing hands-on technical expertise and leadership in a fast-paced, high-impact cybersecurity environment.