threat detection specialist

cFocus Software Incorporated

<div><b>Position Title</b><br>
Threat Emulation &amp; Readiness Lead / Red Team Lead<br>
<b>Position Overview</b><br>
The Threat Emulation &amp; Readiness Lead will oversee adversary emulation, red team operations, cyber readiness exercises, and threat-informed defense initiatives supporting a federal enterprise cybersecurity program.<br>
The Lead will direct realistic adversary simulation activities aligned to nation-state tradecraft and MITRE ATT&amp;CK methodologies to assess and improve organizational detection, response, resilience, and operational readiness.<br>
<b>Key Responsibilities</b><ul><li>
Lead red team operations and adversary emulation exercises.
</li><li>Design and execute:
<ul><li>threat emulation campaigns,
</li><li>purple team exercises,
</li><li>tabletop exercises,
</li><li>crisis simulations,
</li><li>and readiness drills.
</li></ul></li><li>Emulate advanced threat actor TTPs targeting enterprise, cloud, identity, and hybrid environments.
</li><li>Develop attack chains aligned to:
<ul><li>MITRE ATT&amp;CK,
</li><li>intelligence reporting,
</li><li>and real-world threat actor behaviors.
</li></ul></li><li>Coordinate closely with SOC, CTI, Threat Hunt, and Detection Engineering teams.
</li><li>Assess detection and response effectiveness across defensive technologies and operational workflows.
</li><li>Develop after-action reports, findings, remediation recommendations, and improvement roadmaps.
</li><li>Lead operational readiness assessments and continuous improvement initiatives.
</li><li>Brief executives and operational leadership on adversary risk and organizational readiness.
</li></ul><b>Required Qualifications</b><ul><li>
10+ years of offensive security or advanced cybersecurity operations experience.
</li><li>5+ years leading red team or adversary emulation operations.
</li><li>Experience conducting operations against:
<ul><li>enterprise Active Directory environments,
</li><li>cloud infrastructure,
</li><li>hybrid identity systems,
</li><li>and modern endpoint defenses.
</li></ul></li><li>Deep understanding of:
<ul><li>adversary tradecraft,
</li><li>post-exploitation,
</li><li>detection evasion,
</li><li>persistence,
</li><li>and lateral movement techniques.
</li></ul></li><li>Experience conducting purple team engagements and readiness exercises.
</li><li>Strong executive communication and briefing capabilities.
</li></ul><b>Preferred Certifications</b><ul><li>
OSCP
</li><li>OSEP
</li><li>CRTO
</li><li>GXPN
</li><li>GPEN
</li><li>CISSP
</li><li>MITRE ATT&amp;CK certifications</li></ul><p>
</p><p>byKblLEwvK</p></div>

AOUSC - Threat Emulation & Readiness Lead / Red Team Lead

Qiddiya Investment Company

<div><p>Qiddiya Investment Company is seeking an experienced and strategic Manager - Cybersecurity Threat Management to lead our threat management initiatives. In this leadership role, you will be responsible for overseeing the detection, analysis, and mitigation of cybersecurity threats to safeguard the organization's critical information assets and infrastructure.</p><p>
You will drive the development and execution of advanced threat intelligence programs and incident response strategies, collaborating with various teams to ensure a proactive and effective security posture.</p>
Key Responsibilities<ul>
<li>Lead the cybersecurity threat management program, including threat intelligence collection, analysis, and dissemination.</li>
<li>Oversee incident detection and response activities, ensuring timely and effective handling of security incidents.</li>
<li>Develop and implement advanced threat hunting and mitigation strategies tailored to organizational risks and needs.</li>
<li>Collaborate with internal and external stakeholders to enhance threat intelligence sharing and coordination.</li>
<li>Manage and mentor the cybersecurity threat management team, fostering skill development and knowledge sharing.</li>
<li>Prepare and present threat intelligence reports and risk assessments to senior leadership and stakeholders.</li>
<li>Stay abreast of emerging threats, tactics, and technologies, integrating new knowledge into threat management processes.</li>
<li>Ensure compliance with relevant cybersecurity standards, policies, and regulations.</li><br>
</ul><br>
<br>
<b>Requirements</b><br>
<ul>
<li>Bachelor's degree in Cybersecurity, Information Technology, or a related field.</li>
<li>6+ years of experience in cybersecurity threat management, incident response, or related fields.</li>
<li>Deep understanding of threat intelligence frameworks, security operations, and incident response methodologies.</li>
<li>Proven leadership and team management experience.</li>
<li>Familiarity with advanced threat detection tools and technologies.</li>
<li>Excellent analytical, communication, and interpersonal skills.</li>
<li>Relevant certifications such as Certified Information Systems Security Professional (CISSP), Certified Threat Intelligence Analyst (CTIA), or GIAC Certified Incident Handler (GCIH) are highly desirable.</li><br>
</ul><br>
<br>
<b>Benefits</b><p><br>
Comprehensive benefits package</p></div>

Manager - Cybersecurity Threat Management

Al Adyat consultancy

<p><b>Role Overview</b></p><p>Owns end-to-end delivery of threat intelligence onboarding and integration using Anomali, including architecture, data ingestion, enrichment, correlation, and integration with Splunk SIEM and Splunk SOAR to enhance detection, investigation, and automated response capabilities.</p><p><b>Key Responsibilities</b></p><p>&middot; Lead solution architecture and detailed design (HLD / LLD) for threat intelligence integration</p><p>&middot; Deploy, configure, and optimize Anomali Threat Intelligence Platform</p><p>&middot; Onboard threat intelligence feeds and manage lifecycle, scoring, and confidence tuning</p><p>&middot; Integrate Anomali with Splunk SIEM for enrichment, correlation, and detection enhancement</p><p>&middot; Integrate threat intelligence into Splunk SOAR playbooks for automated response</p><p>&middot; Implement use cases aligned to SOC investigation and threat hunting workflows</p><p>&middot; Validate data quality, mappings, and enrichment effectiveness</p><p>&middot; Troubleshoot integration, data, and performance issues</p><p>&middot; Produce operational documentation and conduct knowledge transfer to run teams</p><p>&middot; Support stabilization and transition into BAU operations</p><p><b>Skills and Experience</b></p><p>&middot; Strong hands-on experience with Anomali Threat Intelligence Platform</p><p>&middot; Experience integrating threat intelligence with Splunk SIEM and Splunk SOAR</p><p>&middot; Strong understanding of threat intelligence lifecycle, IOC management, and enrichment</p><p>&middot; Knowledge of SOC operations, threat detection, and incident response</p><p>&middot; Experience producing technical design and operational handover documentation</p><p><b>Key Deliverables</b></p><p>&middot; Threat intelligence architecture and integration design documentation</p><p>&middot; Configured Anomali TIP integrated with Splunk SIEM and SOAR</p><p>&middot; Enrichment and correlation use cases implemented</p><p>&middot; Runbooks, SOPs, and formal handover to operations</p><p>Pay: QAR12,000.00 - QAR14,000.00 per month</p><p>Education:</p><ul><li>Bachelor's (Required)</li></ul><p>Experience:</p><ul><li>Anomali Threat Intelligence Platform: 3 years (Required)</li><li>Splunk SIEM and Splunk SOAR: 3 years (Required)</li></ul><p>Language:</p><ul><li>Arabic  (Required)</li><li>English  (Required)</li></ul><p>License/Certification:</p><ul><li>degree in computer science (Required)</li></ul><p>Location:</p><ul><li>Doha (Required)</li></ul><p>Work Location: In person</p>

Threat Intelligence Specialist (Anomali / Splunk)

Architecture In Motion

<div><p><b>Job Title: </b>SOC Analyst &ndash; Level 2</p>
<p><b>
Location:</b> Pakistan (Remote)</p>
<p><b>
Employment Type: </b>Full-time</p>
<p><b>
Work Model:</b> Remote (24/7 Shift Rotation)</p><p></p><p><b><br>
About Us:</b></p>
<p>
Arancia is a Canadian Cybersecurity Consulting, Advisory and Technology firm based in Mississauga, Ontario. Our team consists of geographically diverse professionals dedicated to solving complex cybersecurity challenges.</p>
<p>
Offering a robust set of services across the IT and Cybersecurity landscape, supported by our proprietary security platform DarkSense, Arancia delivers high-quality security solutions across industries such as Healthcare, Financial Services, and Critical Infrastructure to a global client base.</p>
<p>
Operating a modern 24/7 Security Operations Center, we combine advanced tooling with an evolving Agentic SOC platform to reduce noise, improve detection quality, and enable analysts to focus on meaningful investigations.</p>
<p>
If you are interested in working in a fast-paced, growing cybersecurity environment with a strong focus on innovation, investigation quality, and operational excellence, this role is for you.</p><p></p><p><b><br>
Job Summary:</b></p>
<p>
We are seeking a skilled and highly motivated SOC Analyst &ndash; Level 2 to join our Security Operations team. This role is ideal for someone with hands-on experience in SOC operations, threat investigation, and incident response.</p>
<p>
As an L2 SOC Analyst, you will take ownership of advanced triage and investigation of alerts escalated from L1, execute containment actions across customer environments, and drive detection quality through structured tuning and feedback loops.</p>
<p>
You will work closely with L1 analysts, Detection Engineering, Incident Response, and Threat Intelligence teams, as well as our Agentic SOC platform, to reduce dwell time and false positives. During evening shifts, you will also transition into proactive threat hunting, using dedicated time blocks to identify detection gaps and improve coverage.</p>
<p>
This role serves as a direct progression pathway into L3, Threat Hunting, Detection Engineering, or Incident Response.</p><p></p><p><b><br>
Key Responsibilities:</b></p>
<ul>
<li><b>Alert Triage &amp; Investigation:</b></li>
</ul>
<p>Perform advanced triage of alerts escalated from L1, determining true vs false positives. Investigate security events across endpoint, identity, network, and cloud telemetry. Correlate events and map adversary behavior to MITRE ATT&amp;CK while enriching findings with relevant threat intelligence context.</p>
<ul>
<li><b>Incident Response Execution:</b></li>
</ul>
<p>Execute or coordinate containment actions including host isolation (EDR), account disablement (Entra ID / IAM), and blocking indicators such as IPs, domains, or hashes. Partner with Incident Response teams on high-severity or multi-system incidents and document actions, timelines, and evidence with a clear chain of reasoning.</p>
<ul>
<li><b>Threat Hunting:</b></li>
</ul>
<p>Conduct hypothesis-driven threat hunting across endpoint, identity, and cloud datasets, particularly during evening shifts and on rotation. Convert hunt findings into new detections or tuning recommendations and maintain proper documentation of hunts and derived detections.</p>
<ul>
<li><b>Detection Quality &amp; Tuning:</b></li>
</ul>
<p>Provide structured feedback to Detection Engineering on false positives, detection gaps, and tuning opportunities. Validate new detection rules (Sigma, KQL, SPL, or equivalent) before production rollout and contribute to playbook authoring and continuous improvement.</p>
<ul>
<li><b>Case Management &amp; Reporting:</b></li>
</ul>
<p>Produce clear, complete incident reports suitable for both technical and non-technical stakeholders. Track and support SLA metrics including MTTD, MTTR, and MTTC. Participate in structured shift handovers and post-incident reviews.</p>
<ul>
<li><b>Collaboration &amp; Cross-Functional Teamwork:</b></li>
</ul>
<p>Collaborate closely with internal teams including Detection Engineering, Incident Response, and Threat Intelligence. Mentor L1 analysts on triage quality and investigation techniques, and contribute to internal knowledge bases and lessons-learned sessions.</p><p></p><p><b><br>
Qualifications:</b></p>
<ul>
<li><b>Experience:</b></li>
</ul>
<p>2&ndash;5 years of experience in a SOC, Incident Response, or equivalent hands-on blue team role. Demonstrable experience handling real security incidents end-to-end with a strong understanding of SOC workflows, escalation paths, and on-shift discipline.</p>
<ul>
<li><b>Industry Knowledge:</b></li>
</ul>
<p>Strong understanding of cybersecurity concepts including endpoint, network, identity, and cloud security. Solid grounding in MITRE ATT&amp;CK and its operational application in investigations.</p>
<ul>
<li><b>Technical Skills:</b></li>
</ul>
<p>Hands-on experience with at least one modern SIEM (Microsoft Sentinel, Elastic SIEM, OpenSearch, or similar) and at least one EDR solution (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or similar). Working knowledge of identity and cloud telemetry (Entra ID, Office 365, AWS/Azure logs). Proficiency in KQL is required; additional query languages such as SPL or OpenSearch DQL are a plus. Basic scripting in Python or PowerShell for automation and enrichment.</p>
<ul>
<li><b>Analytical &amp; Soft Skills:</b></li>
</ul>
<p>Strong investigative mindset with the ability to pivot across data sources and build timelines. Clear written communication suitable for customer-facing reports. Ability to remain calm under pressure during live incidents and shift transitions. Team-oriented with a willingness to mentor and continuously learn.</p>
<ul>
<li><b>Education:</b></li>
</ul>
<p>Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent practical experience).</p>
<ul>
<li><b>Certifications:</b></li>
</ul>
<p>Certifications such as BTL1, CySA+, GCIH, Microsoft SC-200, or CompTIA Security+ are considered a plus.</p><p></p><p><b><br>
Nice to Have:</b></p>
<p>
Exposure to SOAR platforms (Cortex XSOAR, Shuffle, Tines), threat intelligence platforms (MISP, OpenCTI), malware analysis or sandboxing tools (Any.Run, Joe Sandbox, Cuckoo), network detection tools (Zeek, Suricata), and cloud security experience across Azure, AWS, or GCP.</p><p></p><p><b><br>
Shift Details:</b></p>
<p>
This role operates on a 24/7 rotating schedule including day, evening, and night shifts. Evening shifts follow a hybrid structure combining live queue work with scheduled threat hunting blocks. Structured handovers are conducted at every shift change to ensure continuity on active incidents. Shift allowances apply for evenings, nights, weekends, and public holidays.</p><p></p><p><b><br>
Onboarding (First 30 Days):</b></p>
<ul>
<li><b>Days 1&ndash;15 &mdash; Shadowing:</b><br>
Pair with senior analysts across shifts to observe live investigations, understand playbooks, tooling, customer environments, and escalation thresholds. No production alert ownership during this phase.</li>
<li><b>Days 16&ndash;30 &mdash; Supervised Queue:</b><br>
Take ownership of alerts under direct supervision. All cases are reviewed with structured feedback on triage decisions, incident response actions, and reporting quality.</li>
<li><b>Day 30+ &mdash; Full Ownership:</b><br>
Independently manage the queue, continue shadowing complex incidents, and rotate into threat hunting responsibilities.</li></ul><br>
<p></p>
<p><b>
What a Typical Shift Looks Like:</b></p>
<p>
Start by reviewing handover notes, open incidents, and any ongoing hunts. Work through the escalation queue by triaging, investigating, containing, and documenting incidents. During evening shifts, execute scheduled hunts or deep-dive into complex investigations. End the shift by updating case notes, preparing a clear handover, and flagging detection tuning opportunities.</p><p></p><p><b><br>
Why Join Us:</b></p>
<ul>
<li>Modern SOC stack and tooling</li>
<li>Agentic SOC platform enabling AI-assisted triage and investigations</li>
<li>Clear career progression into L3, Threat Hunting, Detection Engineering, or IR</li>
<li>Structured onboarding and continuous learning support</li>
<li>Investigation-led culture focused on quality over ticket volume</li></ul><br>
<p></p>
<p><b>
Hours:</b></p>
<p>
40 hours per week (shift-based schedule)</p><p></p><p><b><br>
Compensation:</b></p>
<p>
Market competitive salary based on experience &amp; qualifications.</p></div>

SOC Analyst - Level 2

General Dynamics Electric Boat

<div>Overview:
<div>
Overview<br>
The Chief of Insider Threat Analytics is responsible for overseeing user activity monitoring and behavioral analytics across EB&rsquo;s enterprise network to identify, assess, and mitigate insider threats. This position reports directly to the Chief Information Security Officer (CISO). The role ensures compliance with DFARS, NIST SP 800 171, CMMC, NISPOM Insider Threat Program, GD Corporate Policy, and other applicable regulations. The position leads a team of analysts responsible for insider threat detections, analytics, investigation support, and program operations.</div><div></div><div><br>
Responsibilities<br>
<ul><li>Oversee day to day operations of insider threat monitoring tools and analytics platforms</li><li>Lead development, tuning, and maintenance of behavioral analytics and anomaly detection models</li><li>Manage Insider Threat Analytics policies, procedures, and escalation workflows</li><li>Direct user activity monitoring across endpoints, networks, identity systems, collaboration tools, and data repositories</li><li>Conduct periodic assessments of insider threat risk, trends, and program maturity</li><li>Coordinate investigations with Physical Security, HR, Legal, and Information Technology teams</li><li>Validate security controls related to user privileges, data access, and high risk user groups</li><li>Maintain insider threat related documentation, processes, and audit artifacts</li><li>Oversee configuration management related to insider threat detection and monitor impacts of system changes</li><li>Provide regular reporting, metrics, and briefings to leadership</li><li>Ensure quality assurance of insider threat analytics and detection effectiveness</li></ul></div>
Qualifications:
<div><b>
Required:</b></div><ul><li>
Bachelor&rsquo;s degree in a technical field, such as engineering, computer science, or criminal justice</li><li>
Minimum of 5 years of experience in Insider Threat, Security Operations, or Cybersecurity Analytics</li><li>
Professional advanced cybersecurity certifications such as CISSP, CISM, or various SANS courses</li><li>
Detailed knowledge of DFARS, NIST SP 800 171, CMMC, NISPOM Insider Threat Program guidance</li><li>
Experience with Forensic Collection platforms, SIEM platforms, and behavior-based user monitoring tools</li><li>
Experience interacting with government representatives, auditors, or internal security personnel</li><li>
Secret security clearance is required</li></ul><div><b>
Preferred:</b></div><ul><li>
Master&rsquo;s degree in a business field<br>
Previous law enforcement experience</li><li>
Experience supporting an Insider Threat Program in defense or regulated industries</li></ul>
Skills:
<div>
Skills / Competencies<br>
<ul><li>Strong leadership and team management capabilities</li><li>Ability to work independently in a fast paced environment</li><li>Experience collaborating with cross functional teams spanning Physical Security, HR, Legal, and Information Technology organizations</li><li>Strong analytical, problem solving, and decision making skills</li><li>Excellent written, verbal, and presentation skills</li><li>Strong interpersonal and documentation skills</li></ul></div></div>

Chief of Cybersecurity - Insider Threat Analytics

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

Peraton

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
We are seeking a highly skilled and innovative Threat Hunter to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div><br>
Responsibilities</div><ul><li>
Lead proactive threat‑hunting operations: develop hypotheses, analytic campaigns, and hunting workflows to detect sophisticated adversary behaviors across networks, endpoints, cloud, and OT/DCI systems.</li><li>
Build behavioral detection logic, long‑term analytic patterns, and anomaly models mapped to MITRE ATT&amp;CK TTPs.</li><li>
Leverage threat intelligence, incident trends, CDAP findings, and vulnerability data to prioritize high‑risk hunt objectives and scope.</li><li>
Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence mechanisms, credential misuse, and stealthy C2 activity.</li><li>
Develop hunt playbooks, repeatable methodologies, and validation procedures to elevate enterprise hunting maturity.</li><li>
Integrate hunting outputs into SOC, CIRT, RCC‑ARNG, NETCOM, and ARCYBER operations by delivering actionable detections, validated indicators, and threat behavior insights.</li><li>
Collaborate with detection engineering to convert hunt findings into high‑fidelity detections, tune SIEM/EDR rules, and expand telemetry coverage.</li><li>
Produce detailed technical reports, intelligence briefs, and executive summaries to inform remediation, detection priorities, and strategic risk decisions.</li><li>
Drive continuous improvement: identify telemetry gaps, enhance data‑enrichment pipelines, automate analytic processes, and evaluate emergent hunting tools and techniques.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, Software Engineering, or a related field; OR</li><li>
Relevant DoD/military training (examples: 4‑11‑C32‑255S (CP); 4C‑255N (CP); 4C‑255A (CP); M0923W1; A‑531‑4417; Cyber Defense Analyst (Advanced) Playlist); OR</li><li>
Relevant professional certification or equivalent experience (examples: CBROPS; CFR; CySA+; GCFA; GCIA; GICSP).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat analysis, hunting, or advanced detection experience with at least 3 years leading hunt operations or detection programs in enterprise or DoD contexts.</li><li>
Deep expertise in telemetry analytics, log forensics, memory/disk analysis, and threat‑hunting toolchains (SIEM, EDR, network forensics).</li><li>
Proven ability to author hunt hypotheses, design validation tests, and operationalize findings into detection engineering and incident response workflows.</li><li>
Strong familiarity with MITRE ATT&amp;CK, threat‑intelligence integration, adversary emulation, and validation methodologies.</li><li>
Excellent technical writing and briefing skills for producing reproducible hunt artifacts, IOC packages, and executive‑level intelligence products.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior DoD/ARNG threat‑hunting or CDAP experience and experience coordinating with ARCYBER/NETCOM/RCC‑ARNG.</li><li>
Experience with automation of hunting workflows, advanced analytics (ML/behavioral models), and large‑scale telemetry platforms.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader"><b>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statements:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

THREAT HUNTER

Search 4948+ Threat detection specialist jobs near you this May. New roles added regularly across leading industries. Apply today.