Huntress
Security Operations Analyst
Remote, United States· REMOTE
About the role
Analysts triage platform alerts, review EDR telemetry and forensic artifacts to determine root cause and remediation, and perform tactical malware analysis. They also investigate suspicious Microsoft 365 activity, support threat-related escalations and help tune detections. After initial training, the schedule may include weekends or a 4x10 shift.
What you will do
- Triage, investigate and respond to platform alerts
- Review EDR/SIEM telemetry and forensic artifacts to find root cause
- Perform tactical malware analysis
- Investigate suspicious Microsoft 365 / cloud activity
- Contribute to detection creation and tuning
What they ask for
- 4+ years in a SOC or DFIR role
- Windows, Linux and macOS as attack surfaces
- MITRE ATT&CK and attacker techniques (lateral movement, persistence, evasion)
- Static and dynamic malware analysis
- Active Directory and Group Policy knowledge
- Networking and web/OWASP fundamentals
- Remote within the US
- Schedule may include weekend or 4x10 shifts
Nice to have
- MSP/MSSP/MDR experience
- Linux and macOS investigation skills
- Scripting (PowerShell, Python, Bash, etc.)
- HackTheBox, TryHackMe or Blue Team Labs Online
- CTF or CCDC participation
What applying with Rooted means
This role accepts applications with Rooted context. Instead of sending only a resume, you can attach a verifiable credential with your proofs, rank, and technical evidence.
Your application includes your Rooted credential: rank, verified proofs, and supporting evidence.
You can read this role without an account. To apply you need a Rooted credential.
This role is curated by Rooted. Rooted is not the hiring company unless explicitly stated. The hiring company is Huntress. Confirm the final details with the original source or during the application process.
Posted 2026-06-05