Senior Tactical Response Analyst

Huntress; Northern (KY); Hybrid; USD 125,000 - 135,000; Full time

Benefits offered by this job

Remote work

Paid time off

Parental leave

Medical benefits

401(k)

Job summary

Huntress is a remote-first cybersecurity company seeking a Senior Tactical Response Analyst to own complex, active-adversary cases and high-friction intrusions. You will lead investigations, build defensible timelines, and guide partners through remediation and recovery while producing technical notes for various teams.

You will turn findings into repeatable playbooks, automate opportunities, and validate case findings for scalable threat intelligence.

Qualifications

• 3–5+ years in SOC, MDR, threat hunting, digital forensics, or incident response.
• Experience leading or participating in external-customer incident response engagements.
• Ability to investigate complex/multi-host intrusions with limited oversight.
• Strong understanding of initial access, persistence, lateral movement, credential access, remote access, and ransomware activity.

Responsibilities

• Lead or support cases involving active adversaries and complex coordination.
• Investigate across endpoint, identity, cloud, SIEM, VPN, firewall, Windows, Linux, macOS, and other telemetry.
• Build clear timelines and narratives explaining what happened and what must happen next.
• Provide remediation, eviction, recovery, and recurrence-prevention guidance.
• Explain findings clearly to technical teams, executives, and stakeholders.
• Participate in partner calls with calm, authoritative communication.
• Identify where incidents show Huntress capabilities or need additional coverage.
• Handoff and support post-incident or executive briefings.
• Provide evidence and narrative for account-facing teams, support product feedback, detections, playbooks, automation.
• Develop scripts, automations, dashboards, playbooks, and data-normalization workflows.
• Contribute field intelligence for enablement, briefings, blogs, webinars, and case studies.

Skills

Threat hunting

Incident response

SOC experience

Forensics

Tools

osquery

Velociraptor

EDR platforms

RegRipper

Hayabusa

Chainsaw

Job description

Reports to: Senior Manager, Tactical Response

Location: Remote US

Compensation Range: $125,000 to $135,000 base plus bonus and equity

What We Do:

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 5M+ endpoints and 15M+ identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

What You’ll Do:

Tactical Response owns the difficult, ambiguous part of serious security incidents: understanding what happened, how the attacker gained access, what they did, what remains at risk, and what the partner should do next.

As a Senior Tactical Response Analyst, you will take ownership of complex, active-adversary and high-friction intrusion cases. You will lead deep investigations, build defensible timelines and root-cause narratives, guide partners through remediation and recovery, and communicate clearly during high-stakes incidents.

You will also turn investigation findings into technical notes for account-facing teams, actionable feedback for Product and Detection Engineering, new detections, repeatable playbooks, and automation opportunities, as well as validate case findings to be put in use for scalable threat intelligence.

Responsibilities:

• Lead or support cases involving confirmed active adversaries, hands-on-keyboard activity, serious intrusions, or complex coordination requirements.
• Investigate across endpoint, identity, cloud, SIEM, VPN, firewall, Windows, Linux, macOS, and other available telemetry.
• Build clear, evidence-based timelines and narratives that explain what happened and what must happen next.
• Provide practical remediation, eviction, recovery, and recurrence-prevention guidance.
• Explain complex findings clearly to technical teams, executives, and other stakeholders.
• Participate in partner calls with calm, authoritative, and empathetic communication.
• Identify where an incident demonstrates the value of an existing Huntress capability or indicates a need for additional coverage.
• Facilitate warm technical handoffs and support post-incident or executive briefings.
• Provide the technical evidence and narrative; account-facing teams own the commercial relationship, pricing, and sales process.
  Research emerging attacker tradecraft and test hypotheses against Huntress telemetry and partner environments.
• Develop and improve scripts, automations, dashboards, playbooks, methodology modules, and data-normalization workflows.
• Contribute validated field intelligence and case-derived material to enablement, briefings, blogs, webinars, and case studies when appropriate.
• Mentor responders and represent Tactical Response in cross-functional discussions.

What success looks like:

• Partners receive clear answers, actionable guidance, and confidence during serious incidents.
• Cases close with defensible root-cause, remediation, and recovery outcomes.
• Technical notes give account-facing teams credible context for retention, expansion, and competitive conversations.
• Investigation findings become Product feedback, detection improvements, workflow changes, playbooks, or automation.
• Your work improves the quality, consistency, and scalability of future Tactical Response engagements.

What You Bring To The Team:

• Typically 3–5+ years of experience in SOC, MDR, threat hunting, digital forensics, or incident response.
• Experience leading or participating in external-customer incident response engagements.
• Demonstrated ability to investigate complex or multi-host intrusions with limited oversight.
• Strong understanding of initial access, persistence, lateral movement, credential access, remote access, and ransomware activity.
• Ability to reconstruct attacker activity across systems, data sources, and time periods.
  Experience with Microsoft 365, Azure, identity, VPN, firewall, SIEM, or cloud telemetry.
• Experience with endpoint and forensic tools such as osquery, Velociraptor, EDR platforms, Eric Zimmerman tools, RegRipper, Hayabusa, Chainsaw, or equivalents.
• Working knowledge of Windows internals; Linux and macOS experience is beneficial.
• Working knowledge of static and dynamic malware analysis, indicator extraction, and basic unpacking or deobfuscation.
• Familiarity with OSINT and attacker infrastructure research.
• Strong working knowledge of KQL, EQL, ES|QL, Splunk SPL, or equivalent query languages.
• Experience with Sigma, YARA, Suricata, Snort, or comparable detection formats.
• Ability to identify product, telemetry, detection, and workflow gaps and express them as actionable requirements.
• Demonstrated ability to write concise technical notes, investigation reports, and executive summaries.
• Strong verbal communication, judgement, empathy, and composure during high-pressure partner engagements.
• Experience collaborating with Product, Engineering, Detection Engineering, Sales Engineering, TAM, or other cross-functional teams.

Helpful, but not required:

• Experience designing reusable investigation playbooks or methodology modules.
• Experience developing production-quality automation or data-normalization workflows.
• Experience creating technical enablement, case studies, webinars, blogs, or conference content.
• Relevant certifications or equivalent practical experience in forensics, incident response, threat hunting, or offensive security.

What We Offer:

• 100% remote work environment - since our founding in 2015
• Generous paid time off policy, including vacation, sick time, and paid holidays
• 12 weeks of paid parental leave
• Highly competitive and comprehensive medical, dental, and vision benefits plans
• 401(k) with a 5% contribution regardless of employee contribution
• Life and Disability insurance plans
• Stock options for all full-time employees
• One-time $500 reimbursement for building/upgrading home office
• Annual allowance for education and professional development assistance
• Access to the BetterUp platform for coaching, personal, and professional growth

Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.

We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.

Accommodations:

If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [e-mail] . Please note that non-accommodation requests to this inbox will not receive a response.