Cyber Threat Hunter

CELESTIAL INNOVATIONS GROUP LLC; Oregon; Híbrido; USD 120.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

401(k)

Competitive salary

Dental insurance

Health insurance

Paid time off

Training & development

Vision insurance

Descripción de la vacante

Celestial Innovations Group (CIG) is seeking experienced Threat Hunters focused on digital forensics and incident response. You will work on active matters including ransomware and cloud account compromises, and you will document findings with precise, factual timelines for clients, counsel, and insurers.

Endpoint Threat Hunter and Cloud Threat Hunter capabilities are valued; you will identify compromised systems, write detection rules, and drive containment actions in coordination with

Formación

• 5+ years in cybersecurity, including at least 3 years of hands-on incident response or threat hunting on real intrusions.
• 2+ years of detection engineering: writing, testing, and tuning detections in production.
• Direct experience on ransomware or cloud compromise investigations, ideally in a commercial or multi-tenant setting.
• Proficient in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third.
• Cloud focus: Proficient in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, with working knowledge of at least one of the EDR platforms above.
• Production-quality hunting queries in KQL plus at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable reading Splunk SPL
• Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK
• Scripting in PowerShell and Python
• Solid forensic fundamentals: Windows artifacts (event logs, registry, Prefetch, Amcache, Shimcache, SRUM, $MFT, USN journal), Linux and macOS logs and persistence, triage tools such as KAPE or Velociraptor, the Eric Zimmerman tools, timelining, and basic memory analysis with Volatility or similar
• Knowledge of current ransomware tactics, common initial access vectors, and exfiltration tools such as Rclone, MEGAsync, and Restic
• Understanding of chain of custody and evidence handling that will withstand legal scrutiny
• Strong written English and the ability to brief non-technical stakeholders
• Availability for the full period of performance, including participation in potential on-call rotation covering nights, weekends, and holidays
• Must be a U.S. citizen and reside in the United States
• Must have a commercial background check completed within the last 6 months, or be willing to complete one prior to start

Responsabilidades

• All Threat Hunters
• Support two to four active client matters at a time, with priorities that can shift within the hour
• Proactively hunt across client environments to identify every compromised system and account
• Write and tune detection rules and hunting queries during active incidents
• Drive and recommend containment actions in coordination with the engagement lead
• Keep contemporaneous, factual notes and produce clear timelines and findings suitable for review by clients, counsel, and insurers
• Brief engagement leads, and when requested, clients and counsel
• Validate and tune EDR deployments in new environments, including policy configuration and sensor health review
• Hunt for credential dumping, remote access tool abuse, living off the land binaries, lateral movement, and persistence
• Execute host isolation, process termination, file quarantine, and account disablement
• Collect forensic artifacts remotely using EDR live response capabilities
• Identify, collect, and preserve cloud logs at engagement start and flag logging gaps
• Hunt for identity-based attacks such as token theft, AiTM and device code phishing, MFA fatigue, malicious OAuth grants, and service principal or IAM role abuse
• Trace attacker activity across control plane and data plane logs to establish what was created, changed, accessed, or exfiltrated
• Support containment such as key rotation, session revocation, Conditional Access changes, and removal of attacker persistence

Conocimientos

Threat hunting

Incident response

PowerShell

Python

Cloud security

Strong writing

Herramientas

CrowdStrike Falcon

SentinelOne Singularity

Microsoft Defender for Endpoint

AWS

Azure/Entra ID

GCP

Descripción del empleo

Benefits

• 401(k)
• Competitive salary
• Dental insurance
• Health insurance
• Paid time off
• Training & development
• Vision insurance

About the Role

Celestial Innovations Group (CIG) is looking for experienced threat hunters focused on digital forensics and incident response. We are looking for practitioners who have hunted, investigated, and contained real intrusions, and who can take an alert, an indicator, or a hypothesis and turn it into a confident, documented answer about what happened. You will work alongside an established incident response team on active matters including ransomware and extortion events, cloud account and identity compromises in AWS and Azure, and hands-on-keyboard network intrusions. Engagements move fast: the first 24 to 72 hours often determine the outcome, and you will need to become effective in a new client environment within hours. Many investigations are conducted at the direction of legal counsel, so precise, factual documentation is essential.

Endpoint Threat Hunter and Cloud Threat Hunter. Candidates strong in both are especially welcome.

What You'll Do

• All Threat Hunters
• Support two to four active client matters at a time, with priorities that can shift within the hour
• Proactively hunt across client environments to identify every compromised system and account
• Write and tune detection rules and hunting queries during active incidents
• Drive and recommend containment actions in coordination with the engagement lead
• Keep contemporaneous, factual notes and produce clear timelines and findings suitable for review by clients, counsel, and insurers
• Brief engagement leads, and when requested, clients and counsel

Endpoint Threat Hunters

• Validate and tune EDR deployments in new environments, including policy configuration and sensor health review
• Hunt for credential dumping, remote access tool abuse, living off the land binaries, lateral movement, and persistence
• Execute host isolation, process termination, file quarantine, and account disablement
• Collect forensic artifacts remotely using EDR live response capabilities

Cloud Threat Hunters

• Identify, collect, and preserve cloud logs at engagement start and flag logging gaps
• Hunt for identity-based attacks such as token theft, AiTM and device code phishing, MFA fatigue, malicious OAuth grants, and service principal or IAM role abuse
• Trace attacker activity across control plane and data plane logs to establish what was created, changed, accessed, or exfiltrated
• Support containment such as key rotation, session revocation, Conditional Access changes, and removal of attacker persistence

Required Qualifications

• 5+ years in cybersecurity, including at least 3 years of hands-on incident response or threat hunting on real intrusions
• 2+ years of detection engineering: writing, testing, and tuning detections in production
• Direct experience on ransomware or cloud compromise investigations, ideally in a commercial or multi-tenant setting
• Endpoint focus:
• Proficient in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third
• Cloud focus:
• Proficient in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, with working knowledge of at least one of the EDR platforms above
• Production-quality hunting queries in KQL plus at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable reading Splunk SPL
• Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK
• Scripting in PowerShell and Python
• Solid forensic fundamentals: Windows artifacts (event logs, registry, Prefetch, Amcache, Shimcache, SRUM, $MFT, USN journal), Linux and macOS logs and persistence, triage tools such as KAPE or Velociraptor, the Eric Zimmerman tools, timelining, and basic memory analysis with Volatility or similar
• Knowledge of current ransomware tactics, common initial access vectors, and exfiltration tools such as Rclone, MEGAsync, and Restic
• Understanding of chain of custody and evidence handling that will withstand legal scrutiny
• Strong written English and the ability to brief non-technical stakeholders
• Availability for the full period of performance, including participation in potential on-call rotation covering nights, weekends, and holidays
• Must be a U.S. citizen and reside in the United States
• Must have a commercial background check completed within the last 6 months, or be willing to complete one prior to start

Preferred Qualifications

• Experience with Microsoft Sentinel, Defender XDR, CloudTrail Lake, Athena, GuardDuty, or the Microsoft 365 Unified Audit Log
• Familiarity with cloud forensic tools such as Microsoft Extractor Suite, Hawk, CISA Untitled Goose Tool, or Invictus tooling
• Experience with additional EDR platforms (Carbon Black, Cortex XDR, Elastic Defend, Sophos)
• Detection validation using Atomic Red Team or comparable tooling
• Google Cloud or Google Workspace experience
• Certifications such as GCFA, GCIH, GCFE, GREM, GCTI, GCFR, AWS Certified Security Specialty, AZ-500, CCFH, CCFR, SC-200, SentinelOne certifications, CySA+, or offensive security certifications

Work Environment

• Fully remote with standard business-hours coverage in your time zone, plus potential on-call rotation
• Accounts, tools, and equipment provided as needed
• Strict confidentiality and client data separation required
• This is a remote position.