Senior Incident Response & Threat Hunt Lead (Remote)

Huntress; United States; Remote; USD 125,000 - 135,000; Full time

Benefits offered by this job

Remote work environment

Paid time off

Parental leave

Medical, dental, vision benefits

401(k) with company contribution

Stock options

Home-office stipend

Job summary

Huntress is seeking an experienced Threat Hunter/Incident Response specialist to lead and support complex investigations across endpoints, identity, cloud, and network telemetry. You will build clear, evidence-based timelines, provide remediation guidance, and ensure effective communication with technical teams and executives.

You will leverage tools like OSQuery, Velociraptor, YARA, Sigma, and SIEM telemetry to uncover attacker activity, craft reusable playbooks, and mentor junior responders.

Qualifications

• 3–5+ years of experience in SOC, MDR, threat hunting, digital forensics, or incident response.
• Experience leading or participating in external-customer incident response engagements.
• Demonstrated ability to investigate complex intrusions with limited oversight.
• Strong understanding of initial access, persistence, lateral movement, and ransomware activity.
• Experience with Microsoft 365, Azure, identity, VPN, firewall, SIEM, or cloud telemetry.
• Familiarity with OSINT and attacker infrastructure research.
• Proficiency in KQL, EQL, ES|QL, Splunk SPL, Sigma, YARA, Suricata, or Snort.

Responsibilities

• Lead or support cases involving confirmed active adversaries and complex intrusions.
• Investigate across endpoint, identity, cloud, SIEM, VPN, firewall, and telemetry sources.
• Build evidence-based timelines and narratives of incidents and remediation steps.
• Develop and improve scripts, automations, dashboards, and playbooks.
• Mentor responders and represent Tactical Response in cross-functional discussions.
• Communicate findings clearly to technical teams and executives.

Skills

Incident response

Threat hunting

SOC

Communications

External-customer engagements

Automation scripting

OSINT

Forensics

Cloud telemetry

Windows/Linux/macOS

Digital forensics

SQL/Logs analysis

Tools

osquery

Velociraptor

EDR platforms

RegRipper

Hayabusa

Chainsaw

Sigma

YARA

Suricata

Snort

KQL

EQL

SPL

Python

PowerShell

Bash

Job description

Huntress is seeking an experienced Threat Hunter/Incident Response specialist to lead and support complex investigations across endpoints, identity, cloud, and network telemetry. You will build clear, evidence-based timelines, provide remediation guidance, and ensure effective communication with technical teams and executives.

You will leverage tools like OSQuery, Velociraptor, YARA, Sigma, and SIEM telemetry to uncover attacker activity, craft reusable playbooks, and mentor junior responders.