Cyber Threat Hunter/Incident Responder

Command Post Technologies, Inc.; Arlington (VA); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Great health benefits

Leadership training

401k with generous company matching

Employee Stock Ownership Plan (ESOP)

Career professional development

Tuition reimbursement

Flexible hours

Work/Life balance

Rewards and recognition

Paid Time Off

Parental Leave

Job summary

Command Post Technologies, Inc. (CPT) seeks experienced Cyber Threat Hunters and Incident Responders for anticipated DARPA opportunities in Arlington, VA. The role involves proactive threat hunting, malware investigation, and incident response across enterprise systems.

Ideal candidates have 5+ years in cybersecurity operations, experience analyzing security telemetry, and a strong grasp of TTPs. Onsite work in Arlington is anticipated with a direct impact on defensive capabilities through

Qualifications

• Final DoD Secret security clearance.
• 5+ years of cybersecurity operations experience.
• Experience investigating cybersecurity incidents and analyzing security data.
• Knowledge of adversary TTPs and defensive techniques.
• Experience with SIEM, EDR, and network monitoring tools.
• Proficiency in TCP/IP, DNS, HTTP/S, Windows and Linux.
• Ability to document findings and coordinate investigations.
• Experience following incident response procedures.

Responsibilities

• Conduct proactive threat hunting to identify malicious activity, indicators of compromise, and suspicious behavior.
• Investigate cybersecurity incidents using network traffic, endpoint telemetry, security event logs, and threat intelligence.
• Perform advanced incident analysis to determine attack vectors, scope, impact, and recommended mitigations.
• Analyze suspicious files, email activity, malware indicators, and other artifacts to identify threats.
• Coordinate threat intelligence and incident findings with cybersecurity operations personnel and government stakeholders.
• Support incident response activities including triage, containment, and recovery.
• Develop and refine threat detection methods and hunting procedures.
• Collaborate with CI/CTD analysts and SIEM engineers to improve detection and response processes.

Skills

Threat hunting

Incident response

Digital forensics

Network forensics

TCP/IP/DNS/HTTP/S knowledge

Troubleshooting and analytical skills

Tools

SIEM platforms

EDR tools

Network monitoring technologies

Digital forensic tools

Job description

Description

Command Post Technologies, Inc. (CPT) is seeking experienced Cyber Threat Hunters and Incident Responders for anticipated opportunities supporting the Defense Advanced Research Projects Agency (DARPA) in Arlington, Virginia.

The selected candidate will conduct proactive cyber threat detection, advanced security incident analysis, malware investigation, and incident response activities across enterprise information systems. This position requires hands‑on cybersecurity experience, strong analytical skills, and the ability to identify malicious activity that may not be detected through traditional security monitoring.

Candidates should have experience investigating sophisticated cyber threats, analyzing security telemetry, and developing actionable recommendations to strengthen defensive capabilities.

Key Responsibilities

• Conduct proactive threat hunting activities to identify malicious activity, indicators of compromise, and suspicious behavior across enterprise environments.


• Investigate cybersecurity incidents using network traffic, endpoint telemetry, security event logs, and threat intelligence.


• Perform advanced incident analysis to determine attack vectors, scope, impact, and recommended mitigation actions.


• Analyze suspicious files, email activity, malware indicators, and other artifacts to identify potential threats.


• Conduct threat profiling and analysis of adversary tactics, techniques, and procedures (TTPs).


• Support incident response activities, including triage, investigation, containment, eradication, recovery, and post-incident analysis.


• Develop and refine threat detection methods, hunting procedures, and indicators to improve cybersecurity monitoring effectiveness.


• Analyze network flows, DNS activity, security alerts, and other sources to identify patterns associated with malicious activity.


• Coordinate threat intelligence and incident findings with cybersecurity operations personnel and authorized Government stakeholders.


• Support authorized security assessments and penetration testing activities when required.


• Prepare incident reports, threat assessments, technical findings, and recommendations for improving defensive capabilities.


• Collaborate with CND analysts, SIEM engineers, and other technical personnel to improve threat detection and incident response processes.

Requirements

• Final DoD Secret security clearance, with the ability to meet additional task-order security requirements.


• Minimum of 5 years of relevant experience in cybersecurity operations, threat hunting, incident response, digital forensics, or related disciplines.


• Demonstrated experience investigating cybersecurity incidents and analyzing network or endpoint security data.


• Strong understanding of common adversary TTPs, attack methods, and cybersecurity defensive techniques.


• Experience with SIEM platforms, endpoint detection and response tools, network monitoring technologies, or digital forensic tools.


• Working knowledge of TCP/IP, DNS, HTTP/S, Windows and Linux operating systems, and enterprise security architectures.


• Ability to analyze technical evidence, document findings, and communicate incident information effectively.


• Experience developing or following incident response procedures and coordinating technical investigations.

Desired Qualifications

• Experience supporting DoD hunt teams, CSSP operations, or advanced cybersecurity incident response.


• GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Reverse Engineering Malware (GREM), GCFA, CySA+, or comparable cybersecurity certification.


• Experience with Splunk, Elastic, Microsoft Sentinel, Microsoft Defender for Endpoint, Wireshark, Zeek, or similar tools.


• Familiarity with MITRE ATT&CK, threat intelligence analysis, and detection engineering.


• Experience conducting malware analysis, memory forensics, disk forensics, or email threat analysis.


• Experience using Python, PowerShell, or other scripting languages to support analysis or automate investigations.


• Experience conducting authorized penetration testing or security assessments.


• Experience supporting classified networks or Special Access Program environments.


• Prior experience supporting DARPA or another DoD research and development organization.

Work Location and Schedule

Anticipated work location is Arlington, VA. Specific onsite requirements, operational schedules, incident-response coverage, and travel will be determined by individual task orders.

This requisition supports anticipated task-order opportunities under an awarded contract vehicle. Employment is contingent upon task-order award, funding, and position availability.

About us: We are Command Post Technologies, Inc. (CPT). CPT is a Service-Disabled, Veteran-Owned Small Business (SDVOSB), providing engineering services in the areas of Cyber Security, Software Development, Test & Evaluation, and Strategic Planning. CPT employees appreciate working in a caring environment that promotes a healthy work-life balance. As individuals, we come together as a team, supporting a culture rooted in our core principles of integrity, determination, and innovation. In all of CPT’s collaboration efforts, our team prioritizes communication, accountability, and being resourceful in order to maximize efficiency and results.

What’s In It for You

• Great health benefits (for more info contact us directly)


• Leadership training


• 401k with generous company matching


• Employee Stock Ownership Plan (ESOP)


• Career professional development


• Tuition reimbursement


• Flexible hours


• Work/Life balance


• Rewards and recognition


• Paid Time Off


• Parental Leave

Command Post Technologies, Inc. (CPT) is a Service-Disabled Veteran-Owned Small Business (SDVOSB) founded in 2008 and headquartered in Suffolk, VA with personnel in various states including Virginia, Maryland, Florida, and Texas. With 2/3 of our staff being former military, CPT firmly believes in employing veterans. Command Post Technologies, Inc. is a unique provider of innovative solutions that enhance our corporate clients’ productivity and empower our government clients with the ability to protect against all enemies: foreign and domestic. CPT adapts its successful military experiential approach to the needs of leaders in a global business environment and provides an elite leadership curriculum that results in a world-class, leadership-altering event.

Command Post Technologies Inc. (CPT) is an Equal Employment Opportunity and Affiantive Action employer. We consider applicants without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sex, sexual orientation, marital status, veteran status, disability genetic information, citizenship status, and membership in any other group protected by federal, state, or local law. We take affirmative action to ensure equal opportunities for employees and potential employees without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sex, sexual orientation, marital status, veteran status, disability genetic information, citizenship status, or membership in any other group protected by federal, state, or local law.

We abide by the Pay Transparency Nondiscrimination Provision and will refrain from discharging or otherwise discriminating against employees or applicants who inquire about, discuss, or disclose their compensation or the compensation of other employees or applicants. An exception exists where the employee or applicant makes the disclosure based on information obtained while performing his or her essential job functions.