Cyber Threat Hunter

CELESTIAL INNOVATIONS GROUP LLC

7d•$150,000 - $175,000•Remote

About The Position

Celestial Innovations Group (CIG) is hiring experienced threat hunters focused on digital forensics and incident response. The role is for practitioners who have investigated and contained real intrusions and can turn alerts, indicators, or hypotheses into confident, documented findings. Threat hunters work alongside an established incident response team on matters such as ransomware and extortion events, cloud account and identity compromises in AWS and Azure, and hands-on-keyboard network intrusions. Engagements move quickly, often requiring effectiveness in a new client environment within hours. Because many investigations are conducted at the direction of legal counsel, precise, factual documentation is essential. CIG is hiring for two focus areas: Endpoint Threat Hunter and Cloud Threat Hunter. Candidates with strengths in both areas are especially welcome. The position is fully remote, with standard business-hours coverage in the employee's time zone and a potential on-call rotation. Accounts, tools, and equipment are provided as needed. Strict confidentiality and separation of client data are required.

Requirements

At least 5 years in cybersecurity, including at least 3 years of hands-on incident response or threat hunting on real intrusions.
At least 2 years of detection engineering, including writing, testing, and tuning detections in production.
Direct experience with ransomware or cloud compromise investigations, ideally in a commercial or multi-tenant setting.
Endpoint focus: proficiency in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third.
Cloud focus: proficiency in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, with working knowledge of at least one of the listed EDR platforms.
Production-quality hunting queries in KQL and at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; ability to read Splunk SPL.
Ability to write and tune Sigma and YARA rules and map findings to MITRE ATT&CK.
Scripting skills in PowerShell and Python.
Solid forensic fundamentals, including Windows artifacts (event logs, registry, Prefetch, Amcache, Shimcache, SRUM, $MFT, and USN journal), Linux and macOS logs and persistence, triage tools such as KAPE or Velociraptor, Eric Zimmerman tools, timelining, and basic memory analysis with Volatility or similar.
Knowledge of current ransomware tactics, common initial access vectors, and exfiltration tools such as Rclone, MEGAsync, and Restic.
Understanding of chain of custody and evidence handling that will withstand legal scrutiny.
Strong written English and ability to brief non-technical stakeholders.
Availability for the full period of performance, including participation in a potential on-call rotation covering nights, weekends, and holidays.
Must be a U.S. citizen and reside in the United States.
Must have completed a commercial background check within the last 6 months or be willing to complete one before starting.

Nice To Haves

Experience with Microsoft Sentinel, Defender XDR, CloudTrail Lake, Athena, GuardDuty, or the Microsoft 365 Unified Audit Log.
Familiarity with cloud forensic tools such as Microsoft Extractor Suite, Hawk, CISA Untitled Goose Tool, or Invictus tooling.
Experience with additional EDR platforms such as Carbon Black, Cortex XDR, Elastic Defend, or Sophos.
Experience validating detections using Atomic Red Team or comparable tooling.
Google Cloud or Google Workspace experience.
Certifications such as GCFA, GCIH, GCFE, GREM, GCTI, GCFR, AWS Certified Security Specialty, AZ-500, CCFH, CCFR, SC-200, SentinelOne certifications, CySA+, or offensive security certifications.

Responsibilities

Support two to four active client matters at a time, adapting to priorities that can shift within the hour.
Proactively hunt across client environments to identify compromised systems and accounts.
Write and tune detection rules and hunting queries during active incidents.
Drive and recommend containment actions in coordination with the engagement lead.
Keep contemporaneous, factual notes and produce clear timelines and findings suitable for review by clients, counsel, and insurers.
Brief engagement leads and, when requested, clients and counsel.
For endpoint-focused work, validate and tune EDR deployments in new environments, including policy configuration and sensor health review.
For endpoint-focused work, hunt for credential dumping, remote access tool abuse, living-off-the-land binaries, lateral movement, and persistence.
For endpoint-focused work, execute host isolation, process termination, file quarantine, and account disablement.
For endpoint-focused work, collect forensic artifacts remotely using EDR live response capabilities.
For cloud-focused work, identify, collect, and preserve cloud logs at engagement start and flag logging gaps.
For cloud-focused work, hunt for identity-based attacks, including token theft, AiTM and device code phishing, MFA fatigue, malicious OAuth grants, and service principal or IAM role abuse.
For cloud-focused work, trace attacker activity across control-plane and data-plane logs to establish what was created, changed, accessed, or exfiltrated.
For cloud-focused work, support containment such as key rotation, session revocation, Conditional Access changes, and removal of attacker persistence.