Endpoint Detection & Threat Hunting Analyst

• Endpoint Detection & Threat Hunting Analyst
• Remote (USA)
• Contract: 12+ Months (W2)
• Pay Rate: ~$70/hour

• Position Overview
• We are seeking an experienced Endpoint Detection & Threat Hunting Analyst to join a high-performing cybersecurity team. This role focuses on CrowdStrike Falcon, advanced threat hunting, and endpoint security operations in a large enterprise environment.
• The ideal candidate will be a hands-on Subject Matter Expert (SME) with deep expertise in endpoint protection, incident response, and security automation.

• Key Responsibilities
• Administer and optimize the CrowdStrike Falcon platform
• Perform proactive threat hunting and incident response investigations
• Develop and maintain data pipelines using Cribl
• Integrate telemetry and APIs across SIEM and XDR platforms
• Work with Cisco SecureWorkload (Tetration) for workflow analysis
• Manage endpoint protection policies (IOA exclusions, firewall, USB device control)
• Develop automation workflows (Fusion SOAR)
• Generate reports using APIs and improve detection capabilities
• Analyze logs and security events using SIEM tools (Elastic preferred)

• Required Qualifications
• Core Technical Skills
• Strong experience with CrowdStrike Falcon (SME level)
• Hands-on experience in threat hunting and incident response
• Experience with Cribl (data pipeline creation)
• Knowledge of Cisco SecureWorkload / Tetration
• Experience with XDR platforms (Secureworks preferred)
• Experience with SIEM tools (Elastic preferred)
• Strong understanding of API integrations and automation

• Experience Requirements
• 6+ years of experience with EDR / Endpoint Security platforms
• 6+ years managing CrowdStrike Falcon & SecureWorks
• 3+ years in incident response within enterprise environments
• 3+ years working with Cisco SecureWorkload / Tetration
• 3+ years integrating APIs with SIEM/XDR tools
• 1+ year recent experience with Cribl data pipelines
• 4+ years experience with scripting (Python, PowerShell, Bash)
• 5+ years experience with virtualization, VDI, or cloud SaaS environments
• 2+ years in automation/API integrations

• Preferred Qualifications
• Experience with Axonius
• Strong background in malware analysis, threat intelligence, or sandboxing
• Knowledge of data protection and exposure management tools

• Ideal Candidate Profile
• Proven CrowdStrike SME (not just exposure)
• Strong analytical and investigative mindset
• Experienced in security automation and integrations
• Ability to work independently in a remote, fast-paced environment

• Why Apply?
• Work on cutting-edge cybersecurity technologies
• Fully remote opportunity
• Long-term contract stability (12+ months)
• Opportunity to make an impact as a security SME

Russell Tobin offers eligible employee’s comprehensive healthcare coverage (medical, dental, and vision plans), supplemental coverage (accident insurance, critical illness insurance and hospital indemnity), a 401(k)-retirement savings, life & disability insurance, an employee assistance program, identity theft protection, legal support, auto and home insurance, pet insurance, and employee discounts with some preferred vendors.

• Applicant Privacy Disclosure
• We collect personal information from applicants during the recruiting, pre-offer, and offer process.
• During the recruiting, pre-offer process and offer process, we may collect the following categories of personal information:
• Identifiers, such as name, address, and email address.
• Professional and Employment-Related Information, such as resume, work history, education, and qualifications.
• Information Voluntarily Provided by You in connection with the recruiting and pre-offer process.
• Sensitive Personal Information, where legally permitted and necessary, such as Social Security number and date of birth.

Personal information is collected and used for the following business purposes: evaluating qualifications and eligibility for employment; communication regarding the recruitment and application process; verifying eligibility for employment; and complying with applicable legal, regulatory, and contractual obligations.

Personal information is collected and used only as necessary, and we are committed to data minimization, privacy, and providing equal employment opportunities. We are an international organization, and personal information may be accessed or processed by authorized personnel or service providers located outside the United States, subject to appropriate safeguards. We restrict use and access to personal information to authorized personnel and service providers with confidentiality and data security obligations. We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, or disclosure.

For information about our privacy practices, please review our Privacy Policy at: https://prideglobal.com/privacy-policy

If you do not consent to the collection of such personal information, please advise us immediately in writing at [email protected]

• Equal Employment Opportunity
• Russell Tobin is an equal opportunity employer. We do not discriminate on the basis of the race, religious creed, color, national origin, ancestry, physical disability, mental disability, reproductive health decision making, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, age, sexual orientation, veteran or military status, or any other characteristic protected by applicable federal, state, or local law.

• Fair Chance Employment
• Russell Tobin is a Fair Chance employer. We consider all qualified applicants, including those with criminal histories, in a manner consistent with applicable state and local Fair Chance laws and ordinances, including, the California Fair Chance Act and all applicable local Fair Chance ordinances.

• Accommodations
• We are committed to providing reasonable accommodations to applicants and employees with disabilities. If you require a reasonable accommodation to participate in the application or interview process, or to perform the essential functions of this role, please contact us.

Only applicable for San Francisco Candidates: Under the San Francisco Lactation in the Workplace Ordinance, we will provide written notice of lactation accommodation rights, and this notice will automatically be given upon hiring, any inquiry of parental leave or lactation accommodation