Remote Threat Hunter - Endpoint & Cloud Security

CELESTIAL INNOVATIONS GROUP LLC; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

401(k)

Competitive salary

Dental insurance

Health insurance

Paid time off

Training & development

Vision insurance

Job summary

CELESTIAL INNOVATIONS GROUP LLC is seeking experienced threat hunters focusing on digital forensics and incident response. You will work with an established IR team on active matters including ransomware, cloud identity compromises in AWS/Azure, and hands-on network intrusions, delivering precise, documented findings within tight timeframes.

We have two focus areas: Endpoint Threat Hunter and Cloud Threat Hunter. Strong candidates in both areas are welcome.

Qualifications

• 5+ years in cybersecurity with 3+ years IR or threat hunting on real intrusions.
• 2+ years in detection engineering: writing, testing, and tuning detections.
• Direct experience on ransomware or cloud compromise investigations.
• Endpoint focus: proficient in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third.
• Cloud focus: proficient in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, with working knowledge of at least one of the EDR platforms above.
• Production-quality hunting queries in KQL plus at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable reading Splunk SPL
• Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK
• Scripting in PowerShell and Python
• Solid forensic fundamentals: Windows artifacts, Linux and macOS logs, triage tools, memory analysis basics
• Knowledge of current ransomware tactics, initial access vectors, and exfiltration tools
• Understanding of chain of custody and evidence handling
• Strong written English and ability to brief non-technical stakeholders
• Availability for the full period of performance, including potential on-call rotation
• Must be a U.S. citizen and reside in the United States
• Must have a commercial background check completed within the last 6 months, or be willing to complete one

Responsibilities

• Support two to four active client matters at a time, with priorities that can shift within the hour
• Proactively hunt across client environments to identify every compromised system and account
• Write and tune detection rules and hunting queries during active incidents
• Drive and recommend containment actions in coordination with the engagement lead
• Keep contemporaneous, factual notes and produce clear timelines and findings suitable for review by clients, counsel, and insurers
• Brief engagement leads, and when requested, clients and counsel

Skills

Threat hunting

Incident response

Documentation

Written communication

On-call readiness

Team collaboration

Tools

CrowdStrike Falcon

SentinelOne Singularity

Microsoft Defender for Endpoint

AWS

Azure

GCP

KQL

Sigma rules

YARA rules

PowerShell

Python

Splunk SPL

Job description

CELESTIAL INNOVATIONS GROUP LLC is seeking experienced threat hunters focusing on digital forensics and incident response. You will work with an established IR team on active matters including ransomware, cloud identity compromises in AWS/Azure, and hands-on network intrusions, delivering precise, documented findings within tight timeframes.

We have two focus areas: Endpoint Threat Hunter and Cloud Threat Hunter. Strong candidates in both areas are welcome.