Remote Cyber Incident Lead & Threat Hunter

Covenant HR LLC; United States; Remote; USD 110.000 - 165.000; Vollzeit

Zusammenfassung

Covenant HR LLC is seeking a Cyber Incident Response Lead & Threat Hunter for a remote US-based contract (3-6 months with potential for contract-to-hire). You will serve as the senior technical lead during major cybersecurity incidents, coordinating response across engineering and security teams while guiding containment and recovery actions.

You will work hands-on with CrowdStrike Falcon and Real Time Response, develop advanced KQL or SPL queries, and conduct hypothesis-driven threat hunts

Qualifikationen

• Demonstrated experience leading technical teams during major cybersecurity incidents.
• Hands-on expertise with CrowdStrike Falcon for endpoint investigation, containment, and RTR.
• Advanced query skills in KQL or SPL with proficiency in the other.
• Experience performing threat hunts using MITRE ATT&CK and threat intelligence.
• Investigation across Windows, macOS, Linux, AD, Entra ID, and cloud environments.

Aufgaben

• Serve as the senior technical lead for complex cybersecurity incidents and guide the full incident lifecycle.
• Lead investigations to identify attack vectors, scope, containment, and eradication activities.
• Use CrowdStrike Falcon and RTR to investigate endpoints, collect evidence, and execute containment actions.
• Develop advanced KQL and SPL queries to identify anomalous activity and correlate events.
• Conduct hypothesis-driven threat hunts using MITRE ATT&CK and known adversary TTPs.
• Coordinate with security operations, engineering, and other teams to drive incident response and resolution.
• Communicate incident status, findings, and business impact to security leadership.
• Document findings, root causes, and lessons learned to improve future operations.

Kenntnisse

Incident leadership

CrowdStrike Falcon

KQL / SPL

MITRE ATT&CK

Threat hunting

Multi-OS support

Telemetry analysis

Tools

CrowdStrike RTR

Jobbeschreibung

Covenant HR LLC is seeking a Cyber Incident Response Lead & Threat Hunter for a remote US-based contract (3-6 months with potential for contract-to-hire). You will serve as the senior technical lead during major cybersecurity incidents, coordinating response across engineering and security teams while guiding containment and recovery actions.

You will work hands-on with CrowdStrike Falcon and Real Time Response, develop advanced KQL or SPL queries, and conduct hypothesis-driven threat hunts