Threat Hunt Lead (CBP)

Agile Defense is seeking a Threat Hunt Lead to lead threat hunting for a program supporting U.S. Customs and Border Protection continuous operations. The role involves forming and testing hypotheses about activity the SOC's existing detections might be missing, confirming or ruling them out, and turning findings into detections for other analysts. The position is hybrid, based in Reston, VA. Salary range: $165,000-200,000.

Responsibilities

Lead threat hunting for the program; Form and test hypotheses about activity the SOC's existing detections might be missing; Investigate the environment to confirm or rule out hypotheses; Turn confirmed findings into detections other analysts can rely on; Work closely with the Security Operations Center Manager; Hand confirmed findings to incident response and digital forensics leads; Find activity that automated detection misses; Tune detection logic as conditions change; Preserve evidence and context for digital forensics; Determine when findings need to escalate; Translate threat intelligence into testable hunts; Articulate what has not yet been hunted for and why

Requirements

U.S. Citizenship required; Active Top Secret with SCI eligibility; Ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD; One of the following certifications: GCIA, GCIH, GFCA, or CEH; Minimum of five (5) years of experience as a Tier 3 senior cyber threat hunt analyst performing threat analysis, technical analysis, and network asset traversal; Minimum of five (5) years of hands-on experience, with experience in the last two (2) years, including host and network-based security monitoring using cybersecurity capabilities; Strong cyber security background with experience in host and network-based forensics, identification of advanced cyber threat activities, intrusion detection, malware identification, and security content development (e.g., signatures, rules, queries); Experience interpreting a variety of scripts or programming languages to support threat hunts or malware analysis (e.g., VB scripts, Python, PowerShell, JavaScript, HTML, XML); Experience conducting cyber threat hunt analysis using cyber threat intelligence to identify and prioritize TTPs; Deep knowledge of SIEM and networked-device management tools such as Splunk and EDR solutions; Experience maintaining a comprehensive understanding of the cyber threat landscape; Experience working with the Cyber Threat Intelligence team to report significant findings and coordinating with Pentest team and asset owners to deconflict findings; Experience leading the Cyber Threat Hunt team to propose corrective actions and inform necessary parties of security issues; Strong written and oral communication skills

Nice to have

Additional certifications such as GFCA, GREM, GFNA, OSCP, GPEN; Led or performed structured threat hunting using a framework such as MITRE ATT&CK to form and test hypotheses; Turned a hunt finding into a production detection; Worked in an environment defending against threats targeting government or law enforcement data; Comfortable working from incomplete or ambiguous signals; Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance; Certifications such as GCFA or GNFA

Benefits

Health Insurance; Life Insurance; Paid Time Off; Holiday Pay; Short-term and long-term Disability; Retirement; Learning and Development opportunities; Optional benefit elections; $10,000 signing bonus for candidates who already hold an active CBP BI and EOD, payable after 90 days under standard terms