Cyber Threat Intelligence (CTI) SME (Team Lead)

ECS; Arlington (VA); Hybrid; USD 165,000 - 185,000; Full time

Job summary

Everforth ECS in Arlington, VA is seeking a Cyber Threat Intelligence (CTI) SME (Team Lead) to direct a specialized threat collection and analytics capability within Threat Branch for a National Security client. The role is hybrid in Ballston, VA with potential remote work and contingent upon award.

You will lead a technically proficient team delivering advanced intelligence, map actor behaviors to MITRE ATT&CK, and drive automation-first analytics pipelines that produce actionable hunt leads

Qualifications

• 10+ years in CTI, threat hunting, or threat analysis with leadership experience.

Responsibilities

• Lead a technical CTI team delivering advanced threat intelligence.
• Design, implement, and operate a tailored collection and analytics framework.
• Establish intake-to-execution workflows and ensure alignment with stakeholder needs.

Skills

CTI leadership

Top Secret clearance

Threat hunting

MITRE ATT&CK mapping

Automation pipelines

Data correlation

AI/ML integration

Threat intel leadership

Tools

Threat intel platforms

AI/ML tooling

Job description

Job Description

Everforth ECS is seeking a Cyber Threat Intelligence (CTI) SME (Team Lead) to join our team in Arlington, VA (Hybrid). This position is contingent upon award.

ECS is seeking a CTI SME (Team Lead) to lead a specialized cyber threat collection and analytics capability within Threat Branch in support of our National Security client. The scope of the program includes designing, implementing, and operating a tailored collection and analytics framework to convert diverse external datasets into precise, actionable leads for Proactive Threat Hunting (PHB) and Incident Response (IRB) teams. This position is located in Ballston, VA (Arlington) with the option for routine remote work. In this role, you will lead a highly technical team of threat analysts and engineers delivering advanced threat intelligence, tracking priority PRC adversaries, and deploying automation-first analytics pipelines.

We are seeking an accomplished, dynamic, and hands-on CTI leader with experience managing technical threat intelligence capabilities in a fast-paced environment. The role requires strong technical authority and leadership to establish a unified intake-to-execution workflow that gives stakeholders visibility into intelligence requests, analytics outputs, and service delivery validated against operational needs. Your ability to build high-confidence behavioral fingerprints, map procedure-level actor behaviors to MITRE ATT&CK, and correlate disparate telemetry datasets will be critical to your success.

Salary Range: $165,000 - $185,000

Required Skills

• 10+ years of progressive experience in Cyber Threat Intelligence (CTI), threat hunting, or threat analysis roles, including experience leading technical teams.
• Active Top Secret Clearance with SCI eligibility.
• Demonstrated expertise tracking priority threat actors (including PRC state-sponsored adversaries), victim-facing infrastructure, relay/proxy networks, and obfuscation setups.
• Deep hands-on experience developing high-confidence signatures, fingerprints, and heuristics (e.g., TLS/HTTP behavioral fingerprints, domain/IP clustering).
• Technical proficiency mapping adversary behaviors at the procedure level to the MITRE ATT&CK framework and producing clear hunt/detection guidance.
• Proven capability correlating diverse external datasets (e.g., internet-wide scans, commercial decoy feeds) with internal telemetry and sensor data to drive high-value hunt leads.
• Experience designing and implementing automation-first analytics pipelines, including integrating AI/ML models (e.g., clustering, anomaly detection) with human-in-the-loop validation workflows.
• Experience establishing intake-to-execution workflows to align service models, budgets, and request tracking directly with user operational needs.

Desired Skills

• GIAC Cyber Threat Intelligence (GCTI), Certified Information Systems Security Professional (CISSP), or equivalent technical certifications.
• Experience managing DHS or CISA cybersecurity programs (specifically supporting PHB, IRB, EOS, or Unified Persistent Hunt stakeholders).
• Expertise in evaluating commercial threat feeds and external context providers (e.g., GreyNoise, residential proxy/TOR context feeds) to deliver signal-to-noise and cost-benefit assessments.
• Proven track record of integrating CTI analytics outputs into enterprise target toolsets (e.g., "single pane of glass" dashboards).
• In-depth knowledge of evolving threat actor tactics, techniques, and procedures (TTPs) and advanced data-driven correlation methodologies.

#EverforthECS1

ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.

Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.

Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.

We Value

• Attracting and developing top talent and high-performing teams
• Fostering a culture that is engaging, accountable, and mission-driven

Meet the challenge. Make a difference with Everforth ECS!