Senior Tactical Response Analyst

Who you are

• Typically 3–5+ years of experience in SOC, MDR, threat hunting, digital forensics, or incident response
• Experience leading or participating in external-customer incident response engagements
• Demonstrated ability to investigate complex or multi-host intrusions with limited oversight
• Strong understanding of initial access, persistence, lateral movement, credential access, remote access, and ransomware activity
• Ability to reconstruct attacker activity across systems, data sources, and time periods
• Experience with Microsoft 365, Azure, identity, VPN, firewall, SIEM, or cloud telemetry
• Experience with endpoint and forensic tools such as osquery, Velociraptor, EDR platforms, Eric Zimmerman tools, RegRipper, Hayabusa, Chainsaw, or equivalents
• Strong knowledge of common forensic artefacts, including event logs, registry data, prefetch, jump lists, shellbags, scheduled tasks, services, browser artefacts, and authentication activity
• Working knowledge of Windows internals; Linux and macOS experience is beneficial
• Working knowledge of static and dynamic malware analysis, indicator extraction, and basic unpacking or deobfuscation
• Familiarity with OSINT and attacker infrastructure research
• Strong working knowledge of KQL, EQL, ES|QL, Splunk SPL, or equivalent query languages
• Experience with Sigma, YARA, Suricata, Snort, or comparable detection formats
• Scripting or automation experience with Python, PowerShell, Bash, JavaScript, PHP, Ruby, or similar
• Ability to identify product, telemetry, detection, and workflow gaps and express them as actionable requirements
• Demonstrated ability to write concise technical notes, investigation reports, and executive summaries
• Strong verbal communication, judgement, empathy, and composure during high-pressure partner engagements
• Experience collaborating with Product, Engineering, Detection Engineering, Sales Engineering, TAM, or other cross-functional teams
• Experience designing reusable investigation playbooks or methodology modules
• Experience developing production-quality automation or data-normalization workflows
• Experience creating technical enablement, case studies, webinars, blogs, or conference content
• Relevant certifications or equivalent practical experience in forensics, incident response, threat hunting, or offensive security

What the job involves

• Tactical Response owns the difficult, ambiguous part of serious security incidents: understanding what happened, how the attacker gained access, what they did, what remains at risk, and what the partner should do next
• As a Senior Tactical Response Analyst, you will take ownership of complex, active-adversary and high-friction intrusion cases
• You will lead deep investigations, build defensible timelines and root-cause narratives, guide partners through remediation and recovery, and communicate clearly during high-stakes incidents
• You will also turn investigation findings into technical notes for account-facing teams, actionable feedback for Product and Detection Engineering, new detections, repeatable playbooks, and automation opportunities, as well as validate case findings to be put in use for scalable threat intelligence
• Reports to: Senior Manager, Tactical Response
• Lead or support cases involving confirmed active adversaries, hands-on-keyboard activity, serious intrusions, or complex coordination requirements
• Investigate across endpoint, identity, cloud, SIEM, VPN, firewall, Windows, Linux, macOS, and other available telemetry
• Build clear, evidence-based timelines and narratives that explain what happened and what must happen next
• Provide practical remediation, eviction, recovery, and recurrence-prevention guidance
• Explain complex findings clearly to technical teams, executives, and other stakeholders
• Participate in partner calls with calm, authoritative, and empathetic communication
• Identify where an incident demonstrates the value of an existing Huntress capability or indicates a need for additional coverage
• Facilitate warm technical handoffs and support post-incident or executive briefings
• Provide the technical evidence and narrative; account-facing teams own the commercial relationship, pricing, and sales process
• Research emerging attacker tradecraft and test hypotheses against Huntress telemetry and partner environments
• Develop and improve scripts, automations, dashboards, playbooks, methodology modules, and data-normalization workflows
• Contribute validated field intelligence and case-derived material to enablement, briefings, blogs, webinars, and case studies when appropriate
• Mentor responders and represent Tactical Response in cross-functional discussions
• What success looks like:
• Partners receive clear answers, actionable guidance, and confidence during serious incidents
• Cases close with defensible root-cause, remediation, and recovery outcomes
• Technical notes give account-facing teams credible context for retention, expansion, and competitive conversations
• Investigation findings become Product feedback, detection improvements, workflow changes, playbooks, or automation
• Your work improves the quality, consistency, and scalability of future Tactical Response engagements

Benefits

• 100% Remote: We’ve been a remote team from day one – and we’ve got the tools, systems and processes to be successful outside of a corporate office or HQ.
• PTO & Other Leave: We offer 12 weeks of paid parental leave, along with vacation, sick time, bereavement leave, and floating holidays.
• 401K Match: We offer a 5% contribution to your 401k – even if you’re not paying into it yourself.
• Growth Opportunities: We’re committed to teammate development, both within and outside of Huntress – including education assistance programs like LifeLabs, hands-on training, coaching through BetterUp, and more.
• Health Benefits: Medical, dental, vision, life & disability insurance, pet insurance, and other benefits you’d expect from a company that cares about its team members.
• Stock Options: All full-time teammates receive stock options and benefit from the continued growth and success of the company.
• Digital Monthly Reimbursements: We offer a monthly digital reimbursement for your internet and phone – plus a new starter home office reimbursement.
• Pension: We offer a competitive employer contribution to your pension.
• Health Benefits: Huntress will provide a competitive contribution to put towards a healthcare plan of your choice.
• Pension: We offer a 5% contribution to your Pension – even if you’re not paying into it yourself.
• Health Benefits: Medical, dental, vision, and other benefits you’d expect from a company that cares about its team members.