Cyber Threat Intelligence (CTI) SME (Team Lead)

ecsfederal; Virginia (MN); Hybrid; USD 165,000 - 185,000; Full time

Benefits offered by this job

Hybrid work arrangement

Remote work option

Job summary

Everforth ECS in Arlington, VA (Hybrid) seeks a Cyber Threat Intelligence (CTI) SME Team Lead to guide a specialized threat collection and analytics capability for a National Security client. The role leads a highly technical team, delivering advanced threat intelligence, tracking priority PRC adversaries, and deploying automation-first analytics pipelines.

Salary range is $165,000 - $185,000 with Top Secret clearance eligibility.

Qualifications

• 10+ years of CTI, threat hunting, or threat analysis experience, including leadership of technical teams.
• Active Top Secret clearance with SCI eligibility is required.
• Expertise tracking priority threat actors (including PRC state-sponsored adversaries) and related infrastructure.
• Hands-on experience developing high-confidence signatures, fingerprints, and heuristics.
• Ability mapping adversary behaviors to the MITRE ATT&CK framework and producing hunt/detection guidance.
• Experience correlating diverse external datasets with internal telemetry to drive high-value leads.
• Experience designing automation-first analytics pipelines and integrating AI/ML with human-in-the-loop validation.
• Ability to align intake-to-execution workflows with user operational needs.

Responsibilities

• Lead a technical CTI team delivering advanced threat intelligence and analytics that support PHB and IRB teams.
• Build and manage an intake-to-execution workflow with stakeholders for visibility and delivery.
• Develop and refine automation-first analytics pipelines and behavior fingerprints.
• Track priority actors and map behaviors to MITRE ATT&CK, producing actionable guidance.
• Coordinate with analysts and engineers to ensure timely, validated intelligence outputs.

Skills

CTI leadership

Threat hunting

Team leadership

MITRE ATT&CK

Automation pipelines

Data correlation

Analytical thinking

AI/ML integration

Job description

Everforth ECS is seeking a Cyber Threat Intelligence (CTI) SME (Team Lead)to join our team inArlington, VA (Hybrid).

ECS is seeking a CTI SME (Team Lead) to lead a specialized cyber threat collection and analytics capability within Threat Branch in support of our National Security client. The scope of the program includes designing, implementing, and operating a tailored collection and analytics framework to convert diverse external datasets into precise, actionable leads for Proactive Threat Hunting (PHB) and Incident Response (IRB) teams. This position is located in Ballston, VA (Arlington) with the option for routine remote work. In this role, you will lead a highly technical team of threat analysts and engineers delivering advanced threat intelligence, tracking priority PRC adversaries, and deploying automation-first analytics pipelines.

We are seeking an accomplished, dynamic, and hands-on CTI leader with experience managing technical threat intelligence capabilities in a fast-paced environment. The role requires strong technical authority and leadership to establish a unified intake-to-execution workflow that gives stakeholders visibility into intelligence requests, analytics outputs, and service delivery validated against operational needs. Your ability to build high-confidence behavioral fingerprints, map procedure-level actor behaviors to MITRE ATT&CK, and correlate disparate telemetry datasets will be critical to your success.

Salary Range: $165,000 - $185,000

General Description of Benefits

• 10+ years of progressive experience in Cyber Threat Intelligence (CTI), threat hunting, or threat analysis roles, including experience leading technical teams.
• Active Top Secret Clearance with SCI eligibility.
• Demonstrated expertise tracking priority threat actors (including PRC state-sponsored adversaries), victim-facing infrastructure, relay/proxy networks, and obfuscation setups.
• Deep hands-on experience developing high-confidence signatures, fingerprints, and heuristics (e.g., TLS/HTTP behavioral fingerprints, domain/IP clustering).
• Technical proficiency mapping adversary behaviors at the procedure level to the MITRE ATT&CK framework and producing clear hunt/detection guidance.
• Proven capability correlating diverse external datasets (e.g., internet-wide scans, commercial decoy feeds) with internal telemetry and sensor data to drive high-value hunt leads.
• Experience designing and implementing automation-first analytics pipelines, including integrating AI/ML models (e.g., clustering, anomaly detection) with human-in-the-loop validation workflows.
• Experience establishing intake-to-execution workflows to align service models, budgets, and request tracking directly with user operational needs.