Staff CSIRT Analyst

Huntress Labs; United States; Remote; USD 200,000 - 210,000; Full time

Benefits offered by this job

401(k) with 5% contribution

Paid time off

Parental leave (12 weeks)

Medical, dental, vision benefits

Stock options for all full-time

Home office stipend $500

Job summary

Huntress Labs is seeking a Staff CSIRT Analyst to lead internal security resilience and act as the primary escalation point for the SOC. You will strategize with leaders across functions, own end-to-end incident response, and guide teams to anticipate blockers and drive improvements.

You will collaborate with engineering, product security, and detection teams to optimize telemetry and drive preparedness. This remote role offers a high-impact environment with a focus on proactive security and

Qualifications

• 8+ years of experience in Incident Response, SOC Operations, or Digital Forensics (DFIR).
• Advanced knowledge of EDR/MDR platforms, log aggregation (SIEM/ELK), and cloud security environments (AWS/Azure/M365).
• Proven ability to articulate root causes of complex problems and translate insights into solutions.
• Experience leading small project teams and aligning tech stacks across functions.
• Exceptional ability to convey incident details to technical teams and executives.
• Familiarity with automation/SOAR platforms and documentation tools like Confluence, Jira, and Lucidchart.
• Proactive, forward-thinking approach to security with a culture of security stewardship.

Responsibilities

• Incident Response & Triage: Lead identification, triage, and validation of security incidents; escalation point for SOC.
• Strategic Preparedness: Design and run incident readiness exercises (tabletops, purple teaming).
• Telemetry Optimization: Tune telemetry sources with engineering and detection teams to improve true-positive rate.
• Offensive Security Partnership: Collaborate with Offensive Security to cover visibility gaps and align with product security.
• Continuous Improvement & Leadership: Lead Post-Incident Reviews; own remediation task lifecycle and tooling improvements.
• Stakeholder Communication: Develop and present lessons learned to stakeholders after major incidents.
• Documentation: Create and maintain playbooks, configurations, and incident response standards.

Skills

Incident response

SOC operations

Digital forensics

Cloud security

EDR/MDR

SIEM ELK

Communication

Strategic thinking

Project leadership

Documentation

Tools

Confluence

Jira

Lucidchart

ELK Stack

AWS

Azure

M365

Job description

Reports to: Director of Product Security and Incident Response

Location: Remote US

Compensation Range: $200,000.00 to $210,000.00 plus bonus and equity

What We Do:

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers’ protection.

Huntress now secures more than 5M+ endpoints and 15M+ identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

What You’ll Do:

As a Staff CSIRT Analyst, you will be the cornerstone of Huntress’ internal security resilience. You will act as the primary internal escalation point from our SOC, ensuring we protect ourselves with the same rigor and products we use for our customers. In this role, you will strategize with leaders across multiple functions to identify work streams and own the end-to-end incident response lifecycle. You will guide teams, determine key milestones, and proactively anticipate blockers that could hinder our response capabilities.

Responsibilities:

• Incident Response & Triage: Lead the identification, triage, and validation of security incidents through various telemetry sources, acting as the ultimate escalation point for the SOC.
• Strategic Preparedness: Drive organizational incident readiness by designing and executing practical response exercises (tabletops and purple teaming) to ensure first responders are prepared at all levels of our organization.
• Telemetry Optimization: Partner with engineering, product security, and detection engineering teams to tune existing telemetry sources to a high true-positive rate, reducing noise and increasing detection efficacy.
• Offensive Security Partnership: Collaborate closely with the Offensive Security team to identify visibility gaps and ensure proper coverage against modern threat actor TTPs. Partner with product security, engineering, detection engineering, and other applicable business units to close these gaps rather than treating them as a blocker.
• Continuous Improvement & Leadership : Lead cross-functional Post-Incident Reviews (PIRs) to extract critical lessons learned; own the lifecycle of resulting remediation tasks, driving specific tooling and process enhancements that harden organizational defenses and response against future threats.
• Stakeholder Communication: Develop and present comprehensive reports and “lessons learned” to stakeholders at all levels following major incidents or exercises.
• Documentation: Create and maintain playbooks, system configurations, and incident response standards to ensure scalability and supportability.

What You Bring To The Team:

• Experience: 8+ years of experience in Incident Response, SOC Operations, or Digital Forensics (DFIR).
• Technical Expertise: Advanced knowledge of EDR/MDR platforms, log aggregation (SIEM/ELK), and cloud security environments (AWS/Azure/M365).
• Problem Solving: Proven ability to articulate the root cause of complex problems using first principles and translate insights into technical solutions.
• Strategic Thinking: Experience leading small project teams and aligning tech stacks across functions.
• Communication: Exceptional ability to convey complex technical incident details to both technical teams and executive leadership.
• Tooling: Familiarity with automation/SOAR platforms and documentation tools like Confluence, Jira, and Lucid Chart.
• Mindset: A proactive, forward-thinking approach to security with a passion for building “stewardship of culture” through inclusive and actionable security behaviors.

What We Offer:

• 100% remote work environment - since our founding in 2015
• Generous paid time off policy, including vacation, sick time, and paid holidays
• 12 weeks of paid parental leave
• Highly competitive and comprehensive medical, dental, and vision benefits plans
• 401(k) with a 5% contribution regardless of employee contribution
• Life and Disability insurance plans
• Stock options for all full-time employees
• One-time $500 reimbursement for building/upgrading home office
• Annual allowance for education and professional development assistance
• $75 USD/month digital reimbursement
• Access to the BetterUp platform for coaching, personal, and professional growth

Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are.

We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status.

We do discriminate against hackers who try to exploit businesses of all sizes.

Accommodations:

If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to [e-mail]. Please note that non-accommodation requests to this inbox will not receive a response.

Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights.

#BI-Remote