Cyber Threat Hunter – Threat Detection & Response

Covenant HR; United States; Remote; USD 124,000 - 207,000; Part time

Job summary

Our client in the United States is seeking an experienced Threat Hunter for a 1–2 month contract. This remote role requires hands-on threat hunting across endpoints, networks, identities, and cloud environments, with emphasis on MITRE ATT&CK and advanced analytics.

Responsibilities include intelligence-driven hunts, hypothesis-based investigations, and collaboration with incident response teams to escalate significant findings.

Qualifications

• 3+ years of cybersecurity threat hunting experience.
• Experience investigating adversary activity beyond SOC alerts.
• Proficient with EDR/XDR and SIEM tools and querying.

Responsibilities

• Conduct proactive intelligence-driven threat hunts to identify adversary activity that evades controls.
• Develop and execute hypothesis-based investigations using threat intel and MITRE ATT&CK.
• Analyze large telemetry datasets to uncover suspicious activity and potential compromises.
• Investigate advanced attack techniques including ransomware, credential theft, lateral movement, and data exfiltration.
• Collaborate with incident responders and threat intelligence analysts to validate and escalate findings.
• Reconstruct attacker activity, establish timelines, and document evidence and conclusions.
• Develop reusable hunting queries, playbooks, and recommendations to improve detection.

Skills

Threat hunting

MITRE ATT&CK

Cybersecurity experience

Hypothesis-driven investigations

Escalation of threats

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender for Endpoint

Palo Alto Cortex XDR

Microsoft Sentinel

KQL

Python

PowerShell

Job description

Company - Our client is a leading global technology and consulting organization specializing in cybersecurity, digital transformation, and advanced technology solutions. Recognized for its expertise in protecting complex enterprise environments, the organization helps clients address sophisticated security threats and strengthen cyber resilience.

Location - 100% Remote (United States)

Role Type - Contract (Approximately 1–2 months)

Must Have Skills:

• 3+ years of relevant cybersecurity experience, including significant hands-on, proactive, hypothesis-driven threat hunting experience. Must have experience investigating sophisticated adversary behavior beyond traditional SOC alert monitoring.
• Advanced EDR/XDR and SIEM expertise, including hands-on querying, telemetry correlation, and investigations using tools such as CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, or Palo Alto Cortex XDR.
• Strong knowledge of MITRE ATT&CK, adversary tactics, techniques, and procedures (TTPs), and the ability to translate threat intelligence into actionable hunting hypotheses and identify detection gaps.
• Cross-platform investigation and incident response experience spanning endpoint, network, identity, and cloud environments. Ability to reconstruct attacker activity, develop timelines, and **escalate** validated threats.
• Availability to work primarily weekend overnight shifts, with flexibility for additional coverage as needed.

Responsibilities and Job Details:

• Conduct proactive, intelligence-driven threat hunts to identify sophisticated adversary activity that may evade existing security controls and automated detections.
• Develop and execute hypothesis-based investigations using threat intelligence, behavioral analytics, and MITRE ATT&CK methodologies.
• Analyze large volumes of endpoint, network, identity, and cloud telemetry to uncover suspicious activity and potential compromises.
• Investigate advanced attack techniques, including ransomware, credential theft, lateral movement, persistence, command and control, and data exfiltration.
• Collaborate with incident responders, digital forensic investigators, threat intelligence analysts, and other cybersecurity specialists to validate and **escalate** findings.
• Reconstruct attacker activity, establish investigative timelines, and document supporting evidence and conclusions.
• Develop reusable hunting queries, investigation methodologies, playbooks, and recommendations to improve threat detection capabilities.
• Identify gaps in existing detection coverage and recommend improvements to security monitoring and response processes.
• Leverage advanced security tools and technologies; experience with Microsoft Sentinel, KQL, Python, PowerShell, and cloud telemetry analysis is preferred.
• Prior hands-on Digital Forensics and Incident Response (DFIR) experience is highly desirable.
• Relevant cybersecurity certifications such as GCFA, GNFA, GCIH, GCIA, GCTI, or GDAT are preferred.
• Support our client's global, follow-the-sun Threat Detection & Response operations during a short-term consulting engagement, primarily covering weekend overnight hours.