Incident Response Engineer / Threat Hunter

Job Description : Incident Response Engineer / Threat Hunter Title: Incident Response Engineer / Threat Hunter Location: Remote + Onsite (Hawaii for Initial 1-2 Weeks) travel expense paid Duration: Approximately 240 Hours Position Summary We are seeking a hands-on Incident Response Engineer / Threat Hunter to support cyber incident investigations, forensic evidence collection, threat hunting, and compromise assessments across complex enterprise environments. The selected candidate will perform onsite and remote forensic collection, analyze security telemetry, and support investigative activities under the direction of the Lead DFIR Consultant.

Responsibilities

Perform forensic evidence collection and preservation. Acquire forensic images of servers, desktops, laptops, and mobile devices. Conduct live response and memory acquisition activities. Collect and analyze Windows, Active Directory, firewall, network, and Microsoft 365 logs. Perform threat hunting across endpoints, Active Directory, cloud, and network environments. Conduct packet capture and network forensic analysis. Investigate persistence mechanisms and indicators of compromise. Maintain chain-of-custody documentation and evidence inventories. Support incident investigations and provide findings to the engagement lead. Travel to client sites as required. Required Qualifications 4+ years of Incident Response, Digital Forensics, or Threat Hunting experience. Experience performing forensic acquisition and evidence handling. Strong understanding of Windows Internals and Active Directory. Experience with memory analysis and live response. Experience with packet capture and network analysis. Strong log analysis skills using SIEM platforms. PowerShell and Python scripting experience. Ability to travel and support Hawaii business hours. Preferred Certifications GCFA, GCFE, GCIH, GNFA, GCIA, GCDA, eCIR, Vendor EDR Certifications. Tools & Technologies KAPE, Velociraptor, FTK Imager, EnCase, X-Ways, Magnet AXIOM, Volatility, Wireshark, tcpdump, Zeek, Splunk, Microsoft Sentinel, Elastic, BloodHound, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, PowerShell, Python. Preferred Experience Onsite incident response and forensic collection engagements. Microsoft 365 and BEC investigations. Trellix/McAfee security products. Esri ArcGIS environments. Public sector or government clients. Consulting, MSSP, MDR, or DFIR services experience.