Cyber Threat Hunter

Location: Fully remote within the United States; must be a U.S. citizen and reside in the United States. Standard business-hours coverage in the candidate's time zone is required, with potential on-call rotation covering nights, weekends, and holidays.

Salary: $150,000–$175,000 per year

Company

hirify.global provides client-focused cybersecurity and incident response services, supporting long-term customer relationships and digital investigations.

What you will do

• Support two to four active client matters while adapting to rapidly changing priorities.
• Proactively hunt across client environments to identify compromised systems and accounts.
• Write and tune detection rules and hunting queries during active incidents.
• Recommend and drive containment actions with engagement leads.
• Maintain factual notes and produce timelines and findings suitable for clients, counsel, and insurers.
• For endpoint matters, validate EDR deployments, investigate persistence and lateral movement, isolate hosts, and collect forensic artifacts; for cloud matters, preserve logs, investigate identity attacks, trace control-plane and data-plane activity, and remove persistence.

Requirements

• 5+ years of cybersecurity experience, including at least 3 years of hands-on incident response or threat hunting on real intrusions.
• At least 2 years of production detection engineering, including writing, testing, and tuning detections.
• Direct experience investigating ransomware or cloud compromises, ideally in commercial or multi-tenant environments.
• Endpoint focus: proficiency in at least two of CrowdStrike Falcon, SentinelOne Singularity, and Microsoft Defender for Endpoint, with working knowledge of the third.
• Cloud focus: proficiency in AWS, Azure/Entra ID/Microsoft 365, and/or GCP log investigation, plus working knowledge of at least one listed EDR platform.
• Production-quality KQL queries plus at least one of CrowdStrike Query Language, SentinelOne PowerQuery, or SQL; comfortable reading Splunk SPL.
• Ability to write and tune Sigma and YARA rules, map findings to MITRE ATT&CK, and script in PowerShell and Python.
• Strong forensic fundamentals across Windows, Linux, and macOS, including artifacts, persistence, KAPE or Velociraptor, Eric Zimmerman tools, timelining, and basic memory analysis with Volatility or similar.
• Knowledge of ransomware tactics, initial access vectors, exfiltration tools, chain of custody, and evidence handling suitable for legal scrutiny.
• Strong written English and ability to brief non-technical stakeholders.
• Availability for the full period of performance, including potential nights, weekends, and holiday on-call coverage.
• Must be a U.S. citizen, reside in the United States, and have a commercial background check completed within the last 6 months or complete one before starting.

Nice to have

• Experience with Microsoft Sentinel, Defender XDR, CloudTrail Lake, Athena, GuardDuty, or Microsoft 365 Unified Audit Log.
• Familiarity with Microsoft Extractor Suite, Hawk, CISA Untitled Goose Tool, or Invictus tooling.
• Experience with Carbon Black, Cortex XDR, Elastic Defend, or Sophos.
• Detection validation with Atomic Red Team or comparable tooling.
• Google Cloud or Google Workspace experience.
• Relevant security certifications, including GCFA, GCIH, GCFE, GREM, GCTI, GCFR, AWS Certified Security Specialty, AZ-500, CCFH, CCFR, SC-200, SentinelOne certifications, CySA+, or offensive security certifications.

Culture & Benefits

• Fully remote work with accounts, tools, and equipment provided as needed.
• Health, dental, and vision insurance; 401(k); paid time off; and competitive salary.
• Training and development opportunities with flexible working conditions.
• Strict confidentiality and client data separation are required.
• Culture emphasizes innovation, inclusion, mutual respect, long-term customer relationships, and work-life balance.