Job Description : Incident Response Engineer / Threat Hunter
Title: Incident Response Engineer / Threat Hunter
Location: Remote + Onsite (Hawaii for Initial 1-2 Weeks) travel expense paid
Duration: Approximately 240 Hours
Position Summary
We are seeking a hands-on Incident Response Engineer / Threat Hunter to support cyber incident investigations, forensic evidence collection, threat hunting, and compromise assessments across complex enterprise environments. The selected candidate will perform onsite and remote forensic collection, analyze security telemetry, and support investigative activities under the direction of the Lead DFIR Consultant.
Responsibilities
- Perform forensic evidence collection and preservation.
- Acquire forensic images of servers, desktops, laptops, and mobile devices.
- Conduct live response and memory acquisition activities.
- Collect and analyze Windows, Active Directory, firewall, network, and Microsoft 365 logs.
- Perform threat hunting across endpoints, Active Directory, cloud, and network environments.
- Conduct packet capture and network forensic analysis.
- Investigate persistence mechanisms and indicators of compromise.
- Maintain chain-of-custody documentation and evidence inventories.
- Support incident investigations and provide findings to the engagement lead.
- Travel to client sites as required.
Required Qualifications
- 4+ years of Incident Response, Digital Forensics, or Threat Hunting experience.
- Experience performing forensic acquisition and evidence handling.
- Strong understanding of Windows Internals and Active Directory.
- Experience with memory analysis and live response.
- Experience with packet capture and network analysis.
- Strong log analysis skills using SIEM platforms.
- PowerShell and Python scripting experience.
- Ability to travel and support Hawaii business hours.
Preferred Certifications
GCFA, GCFE, GCIH, GNFA, GCIA, GCDA, eCIR, Vendor EDR Certifications.
Tools & Technologies
KAPE, Velociraptor, FTK Imager, EnCase, X-Ways, Magnet AXIOM, Volatility, Wireshark, tcpdump, Zeek, Splunk, Microsoft Sentinel, Elastic, BloodHound, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, PowerShell, Python.
Preferred Experience
