Cyber Hunt Specialist

Strategic Data Systems, Inc.; Dahlgren (VA); On-site; USD 110,000 - 150,000; Full time

Job summary

Strategic Data Systems, Inc. seeks a Cyber Hunt Specialist in Dahlgren, VA to lead proactive threat hunting across DoD networks. The role requires hands-on experience with hunt methodologies and DFIR tools, and an active DoD clearance.

You will work with DFIR and Threat Intelligence teams to identify advanced threats, develop detection logic, and produce actionable briefings for leadership.

Qualifications

• Five years of cyber threat hunting or related experience.
• Experience with DFIR tools and threat hunting frameworks.
• Active DoD 8570 IAT II certification.
• Active T5 clearance.

Responsibilities

• Execute proactive threat hunting operations to identify, analyze, and mitigate advanced threats.
• Apply Cyber Kill Chain, Pyramid of Pain, and Diamond Model to detect activity.
• Support DFIR and Threat Intelligence teams with actionable findings.
• Refine telemetry collection, detection logic, and analytics for better defense.
• Analyze network traffic, endpoints, and logs for indicators of compromise (IOCs).
• Develop cyber hunt playbooks and SOPs.
• Stay updated on threat trends and collaborate with the cybersecurity community.
• Generate reports and briefings for technical and executive stakeholders.

Skills

Threat hunting

Incident response

Threat intelligence

Adversary TTP analysis

Telemetry analysis

Tools

ELK

Splunk

Wireshark

Mandiant

CrowdStrike

SentinelOne

Job description

Cyber Hunt Specialist

Dahlgren Naval Surface Warfare Center, Dahlgren, VA

Salary negotiable (Dependent on experience level) - Full Time with Benefits

Flexible Start-Date – Contingent on contract award

The Cyber Hunt Specialist will provide advanced cybersecurity expertise supporting Department of Defense (DoD) and U.S. Navy enterprise networks. The successful candidate will lead proactive cyber hunt activities, identify advanced threats, and collaborate with digital forensics, incident response, and threat intelligence teams to enhance the organization’s defensive posture.

This role requires hands‑on experience in threat hunting methodologies, incident response frameworks, and adversary behavior analysis, along with a deep understanding of emerging cyber tactics, techniques, and procedures (TTPs).

Responsibilities

Execute proactive threat hunting operations across complex software and hardware environments to identify, analyze, and mitigate advanced cyber threats.

Apply structured hunt methodologies such as the Cyber Kill Chain, Pyramid of Pain, and Diamond Model to detect, classify, and track adversarial activity.

Provide expert‑level support to Digital Forensics and Incident Response (DFIR) and Threat Intelligence teams, including assistance in identifying and mitigating advanced actor campaigns and exploits.

Refine and develop telemetry collection, detection logic, and analytics to improve situational awareness and network defense capabilities.

Analyze network traffic, endpoint behavior, and logs to identify indicators of compromise (IOCs) and emerging threats.

Support the development and implementation of cyber hunt playbooks and standard operating procedures (SOPs).

Maintain awareness of current and emerging threat trends, vulnerabilities, and attack techniques through ongoing research and collaboration with the cybersecurity community.

Generate actionable reports and briefings to communicate findings and recommendations to technical and executive stakeholders.

To Qualify you will need

• Five (5) years of professional experience in cyber threat hunting, incident response, or advanced cyber defense operations.
• Demonstrated expertise in adversary TTP analysis, threat hunting frameworks, and network/endpoint telemetry.
• Hands‑on experience with common DFIR and threat hunting tools (e.g., ELK, Splunk, Wireshark, Mandiant, CrowdStrike, or SentinelOne).
• Familiarity with scripting or automation for cyber hunt activities (e.g., Python, PowerShell).
• In‑depth knowledge of network protocols (TCP/IP), Windows/Linux environments, and security monitoring tools.
• Must possess a DoD 8570 IAT II certification.
• Must have an active T5 clearance