Threat Hunt Lead (CBP)

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads.

Responsibilities

Lead threat hunting for this program; form and test hypotheses about activity the SOC's existing detections might be missing; dig into the environment to confirm or rule them out; turn findings into detections other analysts can rely on; work closely with Security Operations Center Manager; hand confirmed findings to incident response and digital forensics leads; find what automated detection misses; turn what you find into detection that outlives the hunt; hand off findings clean enough to act on immediately; keep the hunting program grounded in what actually threatens this environment

Requirements

Active Top Secret with SCI eligibility; ability to obtain and maintain CBP Background Investigation (CBP BI) and EOD; active BI strongly preferred; U.S. Citizenship required; Required Certification(s): GIAC, GCIH or CEH; One of the following certifications: GCIA, GCIH or GFCA OR CEH; A minimum of five (5) years of experience as a Tier 3 senior cyber threat hunt analyst performing threat analysis, technical analysis, and network asset traversal; A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host and network-based security monitoring using cybersecurity capabilities; strong cyber security background with experience in host and network-based forensics related to identification of advanced cyber threat activities, intrusion detection, malware identification, and security content development (e.g., signatures, rules, queries etc.); experience interpreting a variety of scripts or programming languages to support cyber threat hunts or malware analysis such as VB scripts, Python, PowerShell, JavaScript, HTML, XML or other types; experience conducting cyber threat hunt analysis utilizing cyber threat intelligence to identify and prioritize tactics, techniques, and procedures to hunt against; deep knowledge of SIEM and networked-device management tools such as Splunk and EDR solutions; experience maintaining a comprehensive understanding of the cyber threat landscape including identifying and analyzing cyber threat actors and activities; will work with Cyber Threat Intelligence team to report significant findings and coordinate with Pentest team and asset owners; will lead Cyber Threat Hunt team to propose corrective actions and inform parties of security issues; strong written and oral communication skills

Nice to have

Additional certifications such as GFCA, GREM, GFNA, OSCP, GPEN; led or performed structured threat hunting using a framework such as MITRE ATT&CK; turned a hunt finding into a production detection; worked in an environment defending against threats targeting government or law enforcement data; comfortable working from incomplete or ambiguous signals; active CBP BI, fitness determination at another DHS component, or active DoD clearance; certifications such as GCFA, GNFA

Benefits

Health Insurance; Life Insurance; Paid Time Off; Holiday Pay; short-term and long-term Disability; Retirement; Learning and Development opportunities; other optional benefit elections; Signing Bonus: $10,000 for candidates with active CBP BI, payable after 90 days