Incident Response Engineer / Threat Hunter

Position Summary

We are seeking a hands-on Incident Response Engineer / Threat Hunter to support cyber incident investigations, forensic evidence collection, threat hunting, and compromise assessments across complex enterprise environments. The selected candidate will perform onsite and remote forensic collection, analyze security telemetry, and support investigative activities under the direction of the Lead DFIR Consultant.

Responsibilities

• Perform forensic evidence collection and preservation.
• Acquire forensic images of servers, desktops, laptops, and mobile devices.
• Conduct live response and memory acquisition activities.
• Collect and analyze Windows, Active Directory, firewall, network, and Microsoft 365 logs.
• Perform threat hunting across endpoints, Active Directory, cloud, and network environments.
• Conduct packet capture and network forensic analysis.
• Investigate persistence mechanisms and indicators of compromise.
• Maintain chain-of-custody documentation and evidence inventories.
• Support incident investigations and provide findings to the engagement lead.
• Travel to client sites as required.

Required Qualifications

• 4+ years of Incident Response, Digital Forensics, or Threat Hunting experience.
• Experience performing forensic acquisition and evidence handling.
• Strong understanding of Windows Internals and Active Directory.
• Experience with memory analysis and live response.
• Experience with packet capture and network analysis.
• Strong log analysis skills using SIEM platforms.
• PowerShell and Python scripting experience.
• Ability to travel and support Hawaii business hours.

Preferred Certifications

GCFA, GCFE, GCIH, GNFA, GCIA, GCDA, eCIR, Vendor EDR Certifications.

Tools & Technologies

KAPE, Velociraptor, FTK Imager, EnCase, X-Ways, Magnet AXIOM, Volatility, Wireshark, tcpdump, Zeek, Splunk, Microsoft Sentinel, Elastic, BloodHound, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, PowerShell, Python.

Preferred Experience

• Onsite incident response and forensic collection engagements.
• Microsoft 365 and BEC investigations.
• Trellix/McAfee security products.
• Esri ArcGIS environments.
• Public sector or government clients.
• Consulting, MSSP, MDR, or DFIR services experience.