Senior Tactical Response Analyst - West Coast

Huntress

14h•Remote

About The Position

Huntress is a fully remote, global team of passionate experts and ethical badasses on a mission to break down the barriers to cybersecurity. Whether creating purpose-built security solutions, hunting down hackers, or impacting our community, our people go above and beyond to change the security game and make a real difference. Founded in 2015 by former NSA cyber operators, Huntress protects all businesses—not just the 1%—with enterprise-grade, fully owned, and managed cybersecurity products at the price of an affordable SaaS application. The Huntress difference is our One Team advantage: our technology is designed with our industry-defining Security Operations Center (SOC) in mind and is never separated from our service. We protect 4M+ endpoints and 7M+ identities worldwide, elevating underresourced IT teams with protection that works as hard as they do. As long as hackers keep hacking, Huntress keeps hunting. The Huntress Tactical Response team has the unique honor of waking up every morning knowing we will be kicking out threat actors. This team sits alongside our 24x7 Security Operations Center team. It is a skilled team of individuals who review lower-confidence signals and manage tactical incident response scenarios to assist customers in exiting critical intrusions. In the Response side of the role, you will have the opportunity to flex your incident response and forensics skills. When customers are experiencing the worst incidents of their lives, this team will step in to answer questions core to understanding the cause of an attack, the high-level activities of the attacker once in the environment, and provide remediation actions and recommendations that will help reduce or eliminate this threat from occurring again in their environment. In between cases, you will get to research new attacker tradecraft, test new theories, and query data at scale for millions of endpoints. If you have a skillset in Incident Response, Threat Hunting, and/or Detection Engineering, and would thrive in the environment and energy of a SOC, this is the role for you!

Requirements

3-5 years working in one or more of the following: SOC, MDR, Threat Hunting, or Incident Response roles
Experience leading or participating in Incident Response engagements for external customers
Experience with tools such as osquery, Velociraptor, or leveraging EDRs to perform forensic artifact analysis on systems
Confident command of forensic tools - such as Ericzimmerman’s EZ tools, RegRipper, Hayabusa, or Chainsaw - and forensic artifacts - such as prefetch, jumplists, shellbags, and more
Deep understanding of offensive security tradecraft, particularly persistence, lateral movement, credential theft, and remote access.
Confidently able to track threat actors across an organization and timeline the activity
Strong familiarity with one or more detection languages such as Sigma, Suricata, Snort, or Yara
Familiarity with OSINT sources and how they can help answer questions relating to threat actor activity and infrastructure
Strong familiarity with various query languages such as KQL, EQL, ES|QL, Splunk SPL
Intermediate malware analysis skills
Intermediate knowledge of Windows internals
Strong understanding of the current threat landscape, initial access brokers, and ransomware actors
Passionate and involved with the community through blogs, social media, conferences, etc.
Experience with scripting (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby)
Demonstrable experience providing written and/or verbal customer-facing deliverables
Comfortable using Git to contribute to internal projects

Nice To Haves

Intermediate knowledge of Linux and macOS internals is a bonus
Experience with detection and response in cloud environments such as Microsoft M365/Azure

Responsibilities

Lead or support tactical incident response engagements for customers who already utilize Huntress MDR.
Perform live analysis on systems to determine the root cause of an intrusion, and craft reports that summarize the intrusion, with the next steps to be taken
Research, develop, and test new tooling in the form of automations, scripts, and tools for analysis
Perform intermediate malware analysis as part of response efforts
Perform OSINT as part of response efforts
Contribute to content creation efforts such as blogs, videos, podcasts, and webinars
Contribute to community-driven projects and frameworks, such as MITRE ATT&CK, HijackLibs, and the LOLBAS Project.
Speak with customers to explain or summarize findings from investigations