Cyber Threat Hunter (Mid-Level)

cFocus Software Incorporated; Washington (District of Columbia); Remote; USD 80,000 - 120,000; Full time

Job summary

Join a forward-thinking company as a Cyber Threat Hunter, where your expertise will play a crucial role in safeguarding critical information systems. This mid-level position involves identifying and investigating cyber threats, conducting malware analysis, and providing forensic support to high-tech investigations. You will work with advanced security tools and collaborate with government entities to enhance cyber defense strategies. If you're passionate about cybersecurity and eager to make a significant impact in a dynamic environment, this opportunity is perfect for you. Embrace the chance to work remotely while contributing to vital security initiatives.

Qualifications

• 5+ years of experience in cyber threat hunting and incident response.
• Active Public Trust clearance and 8570 compliance required.

Responsibilities

• Identify and investigate computer and network intrusions.
• Conduct malware analysis and provide forensic support for investigations.
• Monitor security devices and assess patterns from raw events.

Skills

Cyber Threat Hunting

Malware Analysis

Computer Forensics

Incident Response

Security Information and Event Management (SIEM)

Education

Bachelor’s Degree in Computer Science or related field

Tools

Splunk

Crowdstrike

Sysmon

Microsoft Azure

Microsoft O365

Zscaler

Jira

Job description

cFocus Software seeks a Cyber Threat Hunter (Mid-Level) to join our program supporting USDOT in Washington, DC. This position has remote capabilities. This position requires an active Public Trust clearance and must meet 8570 requirements.

Qualifications:

1. Bachelor’s Degree or equivalent experience in a computer, engineering, or science field.
2. Active Public Trust clearance.
3. 8570 Compliant (Security+ CE).
4. Hold active certifications such as GCIA or GCIH or GSEC or GMON, and Splunk Core Power User.
5. 5+ years of relevant experience.

Duties:

1. Identifies, deters, monitors, and investigates computer and network intrusions.
2. Provide computer forensic support to high technology investigations in the form of evidence seizure, computer forensic analysis, and data recovery.
3. Monitor and assess complex security devices for patterns and anomalies from raw events (DNS, DHCP, AD, SE logs), tag events for Tier 1 & 2 monitoring.
4. Conduct malware analysis in out-of-band environment (static and dynamic), including complex malware.
5. Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now), for threat hunt support.
6. Threat hunt targets include cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (i.e., Zscaler).
7. Review and analyze risk-based Security information and event management (SIEM) alerts when developing hunt hypotheses.
8. Review open-source intelligence about threat actors when developing hunt hypotheses.
9. Plan, conduct, and document iterative, hypothesis based, tactics, techniques, and procedures (TTP) hunts utilizing the agile scrum project management methodology.
10. At the conclusion of each hunt, propose, discuss, and document custom searches for automated detection of threat actor activity based on the hunt hypothesis.
11. Configure, deploy, and troubleshoot Endpoint Detection and Response agents (e.g., Crowdstrike and Sysmon).
12. Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.
13. Track and document cyber defense incidents from initial detection through final resolution.
14. Interface with IT contacts at court or vendor to install or diagnose problems with EDR agents.
15. Participate in government led after action reviews of incidents.
16. Triage malware events to identify the root cause of specific activity.
17. Attend daily Agile Scrum standups and report progress on assigned Jira stories.