Cyber Threat Intelligence (CTI) SME (Team Lead)

ECS Corporate Services; Arlington (VA); Hybrid; USD 165,000 - 185,000; Full time

Job summary

Everforth ECS in Arlington, VA (Hybrid) seeks a Cyber Threat Intelligence Team Lead to guide a specialized CTI collection and analytics capability for a National Security program. You will lead threat analysts and engineers to deliver advanced intelligence, track priority actors, and drive automation-first analytics pipelines.

The role demands strong technical authority, proven leadership, and the ability to map actor behaviors to MITRE ATT&CK, integrate diverse datasets, and provide clear hunt

Qualifications

• 10+ years of CTI/threat analysis experience, including leading technical teams.
• Active Top Secret Clearance with SCI eligibility.
• Experience tracking priority threat actors (including PRC state-sponsored) and related infrastructure.
• Hands-on development of high-confidence signatures, fingerprints, and heuristics.
• Proficiency mapping adversary behaviors to MITRE ATT&CK and producing hunt/detection guidance.
• Ability to correlate diverse datasets with internal telemetry to drive hunt leads.
• Experience designing automation-first analytics pipelines, including AI/ML model integration.
• Experience establishing intake-to-execution workflows aligned with user needs.

Responsibilities

• Lead a highly technical CTI team delivering advanced threat intelligence.
• Oversee collection and analytics capability within Threat Branch for national security client.
• Develop and implement automation-first analytics pipelines and validation workflows.
• Map actor behaviors to MITRE ATT&CK and provide actionable hunt/detection guidance.
• Maintain visibility into intelligence requests, outputs, and service delivery for stakeholders.

Skills

Leadership

Threat intelligence

Team leadership

MITRE ATT&CK mapping

Automation pipelines

AI/ML integration

Threat actor tracking

Stakeholder communication

Tools

MITRE ATT&CK framework

AI/ML models

Job description

Everforth ECS is seeking a Cyber Threat Intelligence (CTI) SME (Team Lead) to join our team in Arlington, VA (Hybrid). ECS is seeking a CTI SME (Team Lead) to lead a specialized cyber threat collection and analytics capability within Threat Branch in support of our National Security client. The scope of the program includes designing, implementing, and operating a tailored collection and analytics framework to convert diverse external datasets into precise, actionable leads for Proactive Threat Hunting (PHB) and Incident Response (IRB) teams. This position is located in Ballston, VA (Arlington) with the option for routine remote work. In this role, you will lead a highly technical team of threat analysts and engineers delivering advanced threat intelligence, tracking priority PRC adversaries, and deploying automation-first analytics pipelines. We are seeking an accomplished, dynamic, and hands-on CTI leader with experience managing technical threat intelligence capabilities in a fast-paced environment. The role requires strong technical authority and leadership to establish a unified intake-to-execution workflow that gives stakeholders visibility into intelligence requests, analytics outputs, and service delivery validated against operational needs. Your ability to build high-confidence behavioral fingerprints, map procedure-level actor behaviors to MITRE ATT&CK, and correlate disparate telemetry datasets will be critical to your success.

Salary Range: $165,000 - $185,000

General Description of Benefits

• 10+ years of progressive experience in Cyber Threat Intelligence (CTI), threat hunting, or threat analysis roles, including experience leading technical teams.
• Active Top Secret Clearance with SCI eligibility.
• Demonstrated expertise tracking priority threat actors (including PRC state-sponsored adversaries), victim-facing infrastructure, relay/proxy networks, and obfuscation setups.
• Deep hands-on experience developing high-confidence signatures, fingerprints, and heuristics (e.g., TLS/HTTP behavioral fingerprints, domain/IP clustering).
• Technical proficiency mapping adversary behaviors at the procedure level to the MITRE ATT&CK framework and producing clear hunt/detection guidance.
• Proven capability correlating diverse external datasets (e.g., internet-wide scans, commercial decoy feeds) with internal telemetry and sensor data to drive high-value hunt leads.
• Experience designing and implementing automation-first analytics pipelines, including integrating AI/ML models (e.g., clustering, anomaly detection) with human-in-the-loop validation workflows.
• Experience establishing intake-to-execution workflows to align service models, budgets, and request tracking directly with user operational needs.