Cyber Threat Hunter (Senior)

cFocus Software Incorporated; Washington (District of Columbia); Remote; USD 90,000 - 135,000; Full time

Job summary

An established industry player is looking for a Senior Cyber Threat Hunter to join their dynamic team in Washington, DC. This role offers the opportunity to work remotely while supporting the US Courts. The ideal candidate will possess extensive experience in threat hunting and incident response, utilizing advanced tools to identify and mitigate threats. You will engage in proactive threat hunts, analyze security incidents, and collaborate with various stakeholders to enhance cybersecurity measures. If you are passionate about cybersecurity and ready to make a significant impact, this is the perfect opportunity for you.

Qualifications

• 5+ years of experience in threat hunting and incident response.
• Strong knowledge of tools like Splunk, CrowdStrike, and Microsoft Sentinel.

Responsibilities

• Conduct threat hunts and respond to incidents across cloud and non-cloud environments.
• Develop and document hunt hypotheses and detection logic.

Skills

Threat Hunting

Incident Response

Data Analysis

Hypothesis-based Threat Hunting

Risk Assessment

Education

Relevant Cybersecurity Certifications

Tools

Splunk Enterprise Security

Microsoft Sentinel

CrowdStrike

Sysmon

Tenable Nessus

Zscaler

Auditd

NetScout

Job description

cFocus Software seeks a Cyber Threat Hunter (Senior) to join our program supporting US Courts in Washington, DC. This position has remote capabilities. This position requires an active Public Trust clearance and must meet 8570 requirements.

Required Qualifications include:

1. 5 years of experience performing threat hunts & incident response activities for cloud-based and non-cloud-based environments, such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Zscaler
2. 5 years of experience performing hypothesis-based threat hunt & incident response utilizing Splunk Enterprise Security.
3. 5 years of experience collecting and analyzing data from compromised systems using EDR agents (e.g. CrowdStrike) and custom scripts (e.g. Sysmon & Auditd)
4. 5 years of experience with the following threat hunting tools:
   • Microsoft Sentinel for threat hunting within Microsoft Azure;
   • Tenable Nessus and SYN/ACK for vulnerability management;
   • NetScout for analyzing network traffic flow;
   • SPUR.us enrichment of addresses;
   • Mandiant Threat intel feeds;
5. Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC

Desired Qualifications include:

• One of the following certifications:
  • GIAC Certified Intrusion Analyst (GCIA)
  • GIAC Certified Incident Handler (GCIH)
  • GIAC Continuous Monitoring (GMON)
  • GIAC Defending Advanced Threats (GDAT)
  • Splunk Core Power User

Duties:

• Provide incident response services after an incident is declared and proactively search for security incidents that would not normally be detected through automated alerting.
• The Threat Hunt mission is to explore datasets across the judicial fabric to identify unique anomalies that may be indicative of threat actor activity based on the assumption that the adversary is already present in the judicial fabric. The extended mission is to conduct counterintelligence, build threat actor dossiers, disrupt adversary operations, identify misconfigurations/vulnerabilities, and identify visibility/detection gaps, if any.
• Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now), for threat hunt support. Threat hunt targets include cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (i.e., Zscaler).
• Review and analyze risk-based Security information and event management (SIEM) alerts when developing hunt hypotheses.
• Review open-source intelligence about threat actors when developing hunt hypotheses.
• Plan, conduct, and document iterative, hypothesis-based, tactics, techniques, and procedures (TTP) hunts utilizing the agile scrum project management methodology.
• At the conclusion of each hunt, propose, discuss, and document custom searches for automated detection of threat actor activity based on the hunt hypothesis.
• Configure, deploy, and troubleshoot Endpoint Detection and Response agents (e.g., CrowdStrike and Sysmon).
• Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.
• Track and document cyber defense incidents from initial detection through final resolution.
• Interface with IT contacts at court or vendor to install or diagnose problems with EDR agents.
• Participate in government led after action reviews of incidents.
• Triage malware events to identify the root cause of specific activity.
• Attend daily Agile Scrum standups and report progress on assigned Jira stories.

Deliverables:

• Hunt Hypotheses: Hunt hypotheses describe how an actor might operate in the network while remaining undetected.
• Hunt Reports: Hunt reports describe the original hypothesis and all iterations.
• Detection Logic: Document and test detection logic for automated detection of threat actor activity based on hunt hypothesis.
• Advanced SME IR Reports: Timely Advanced SME IR Support for Priority 1 Security Events.
• Incident Report: Document all incident details in an incident report.
• Provide Weekly Reports to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on.
• Document repeatable Standard Operation Procedures (SOPs) and playbooks for security use cases.