AOUSC - Threat Hunt Lead

cFocus Software Incorporated; Washington (District of Columbia); Hybrid; USD 140,000 - 170,000; Full time

Job summary

cFocus Software seeks a Threat Hunt Lead to join our program supporting AOUSC. The role is Hybrid with onsite in Washington, DC, and requires a Public Trust clearance.

You will lead threat hunting operations, develop execution plans, and collaborate across intelligence, detection engineering, and incident response teams to strengthen judiciary security. Ideal candidates bring 5+ years in IR, proficiency in tools like Splunk and Microsoft Sentinel, and a background in scripting

Qualifications

• B.S. Computer Science, Information Technology, or a related field.
• Active Public Trust clearance.
• 5+ years within IR in a large SOC with 3+ years on proactive threat hunting.
• 3+ years of hypothesis-driven data analysis for APT behavior.
• 2+ years scripting with Python and PowerShell to develop new tools.
• Active OSCP or GXPN certification.

Responsibilities

• Lead proactive threat hunting operations to identify APTs, insider threats, and anomalies.
• Develop and execute hypothesis-driven hunts using threat intelligence and TTPs.
• Coordinate hunt activities within Agile two‑week sprints; ensure completion of objectives.
• Develop Threat Hunt Execution Plans with hypotheses, telemetry, and procedures.
• Analyze endpoint, network, cloud, SIEM, EDR, and log telemetry for IOCs and attack patterns.
• Coordinate with Cybersecurity Triage and Incident Response teams per JSOCIRP.

Skills

Threat hunting

Python

PowerShell

Adversary emulation

Data analysis

Threat intelligence

Education

B.S. Computer Science / Information Technology or related field

OSCP or GXPN certification

Tools

Splunk

Microsoft Sentinel

Splunk SOAR

CrowdStrike

Qualys

ServiceNow

Jira

Job description

cFocus Software seeks a Threat Hunt Lead to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.

Qualifications:

• Active Public Trust clearance
• B.S. Computer Science, Information Technology, or a related field
• 5+ years within IR in a large SOC (over 5,000 endpoints) with at least 3 years focused on proactive threat hunting or adversary emulation.
• 3+ years of experience with demonstrated proficiency in forming hypothesis, querying large datasets and identifying APT behavior.
• 2+ years’ experience with demonstrated proficiency in scripting languages including Python and PowerShell to develop new tools.
• This role most closely aligns with the NICE work role PD-WRL-006 (Threat Analysis).
• Active OSCP or GXPN certification

Duties:

• Lead proactive threat hunting operations to identify Advanced Persistent Threats (APT), insider threats, malicious activity, and anomalous behaviors that evade traditional security controls.
• Develop and execute hypothesis-driven threat hunts leveraging threat intelligence, adversary tactics, techniques, and procedures (TTPs), behavioral analytics, and anomalous telemetry.
• Coordinate threat hunt activities within Agile two‑week sprint cycles and ensure successful execution of all assigned hunt objectives and deliverables.
• Develop Threat Hunt Execution Plans that define hunt hypotheses, objectives, technical methodologies, required telemetry, and investigative procedures.
• Analyze endpoint, network, cloud, identity, SIEM, EDR, and log telemetry to identify indicators of compromise (IOCs), suspicious activity, and attack patterns.
• Coordinate and escalate confirmed or suspected findings to the Cybersecurity Triage and Incident Response teams in accordance with the Judiciary SOC Incident Response Plan (JSOCIRP).
• Collaborate with Detection Engineering teams to identify and remediate logging, telemetry, detection, or visibility gaps discovered during threat hunting operations.
• Work closely with Cyber Threat Intelligence teams to operationalize intelligence, enrich investigations, and identify emerging threats impacting the Judiciary.
• Conduct advanced analysis of threat actor behaviors, malware campaigns, phishing activity, suspicious infrastructure, and attack trends.
• Develop detailed Threat Hunt Reports documenting hunt objectives, findings, TTPs, queries used, telemetry gaps, identified risks, and recommendations for improved detections.
• Produce executive‑level Hunt Sprint Reports summarizing hunt activities, operational impacts, recommendations, and emerging cyber‑security risks.
• Provide real‑time investigative support during cybersecurity incidents and high‑priority threat investigations.
• Perform analysis utilizing Splunk Enterprise Security, Microsoft Sentinel, Splunk SOAR, CrowdStrike, Qualys, ServiceNow, Jira, and other AO‑approved security platforms.
• Support the development and refinement of threat models tailored to Judiciary systems, high‑value assets, and mission‑critical environments.
• Develop and maintain threat hunting SOPs, playbooks, technical procedures, and investigative methodologies aligned with AO and federal cybersecurity standards.
• Support enterprise security awareness initiatives through threat briefings, technical reporting, and operational presentations.
• Participate in weekly technical meetings, operational reviews, and status briefings with AO leadership and federal stakeholders.
• Provide mentorship, technical guidance, and quality oversight to threat hunters and supporting analysts.
• Support transition‑in and transition‑out activities, operational readiness, documentation development, and knowledge transfer activities.
• Drive continuous improvement initiatives focused on detection coverage, telemetry enrichment, operational efficiency, and threat hunting maturity.