AOUSC - Cyber Threat Intelligence & Threat Hunting Lead

cFocus Software Incorporated; Washington; On-site; USD 140,000 - 210,000; Full time

Job summary

cFocus Software Incorporated is seeking a Cyber Threat Intelligence & Threat Hunting Lead to oversee CTI, detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions.

The Lead will drive intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities.

Qualifications

• 10+ years of cybersecurity operations experience.

Responsibilities

• Lead CTI, detection engineering, and threat hunting operations.
• Develop intelligence-driven detection and hunt strategies.
• Produce operational and strategic threat intelligence reporting.
• Develop and maintain: SIEM detections, analytics, correlation rules, behavioral detections, and hunt playbooks.
• Conduct hypothesis-based threat hunting aligned to MITRE ATT&CK, adversary TTPs, malware campaigns, and emerging threats.
• Integrate CTI into SOC workflows, detection engineering, and incident response operations.
• Analyze malware trends, adversary infrastructure, campaigns, indicators, and attack patterns.
• Support automation and SOAR integration initiatives.
• Brief executives and technical leadership on emerging threats and operational risk.

Skills

CTI

Threat Hunting

Detection Engineering

SIEM Content

Threat Analytics

MITRE ATT&CK

EDR Telemetry

Education

GCTI

GCFA

GCIH

GMON

GCDA

CISSP

Splunk Security Certifications

Tools

Splunk

Microsoft Sentinel

CrowdStrike

EDR Telemetry

Detection Content Engineering

Intelligence Platforms

Job description

Position Title

Cyber Threat Intelligence & Threat Hunting Lead

Position Overview

The Cyber Threat Intelligence & Threat Hunting Lead will oversee integrated cyber threat intelligence (CTI), detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions.

The Lead will drive development of intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities.

Key Responsibilities

• Lead CTI, detection engineering, and threat hunting operations.
• Develop intelligence-driven detection and hunt strategies.
• Produce operational and strategic threat intelligence reporting.
• Develop and maintain:
  • SIEM detections,
  • analytics,
  • correlation rules,
  • behavioral detections,
  • and hunt playbooks.
• Conduct hypothesis-based threat hunting aligned to:
  • MITRE ATT&CK,
  • adversary TTPs,
  • malware campaigns,
  • and emerging threats.
• Integrate CTI into SOC workflows, detection engineering, and incident response operations.
• Analyze:
  • malware trends,
  • adversary infrastructure,
  • campaigns,
  • indicators,
  • and attack patterns.
• Support automation and SOAR integration initiatives.
• Brief executives and technical leadership on emerging threats and operational risk.

Required Qualifications

• 10+ years of cybersecurity operations experience.
• 5+ years supporting CTI, threat hunting, or detection engineering programs.
• Experience with:
  • Splunk,
  • Sentinel,
  • CrowdStrike,
  • EDR telemetry,
  • detection content engineering,
  • and intelligence platforms.
• Strong understanding of:
  • MITRE ATT&CK,
  • adversary tradecraft,
  • malware analysis,
  • and intelligence analysis methodologies.
• Experience developing:
  • SIEM detections,
  • hunt analytics,
  • detection tuning,
  • and operational reporting.

Preferred Certifications

• GCTI
• GCFA
• GCIH
• GMON
• GCDA
• CISSP
• Splunk Security certifications