On-Site Threat Operations Analyst (TS/SCI)

Trinity Cyber; Washington (District of Columbia); On-site; USD 120,000 - 160,000; Full time

Job summary

Trinity Cyber is seeking a Resident Threat Operations Analyst to serve as the embedded technical authority for a major government customer. The role is on-site in the Washington, DC metro area and requires an active TS/SCI clearance.

You will advise customer cyber operations teams on maximizing FCI effectiveness, surface detection opportunities, and translate mission requirements into capabilities delivered by Trinity Cyber.

Qualifications

• Active TS/SCI clearance is required for the role.
• Experience with threat hunting, incident response, or SOC operations in classified environments.
• Experience operationalizing network detection technology in production environments.

Responsibilities

• Translate customer threat intelligence into FCI countermeasures and COA recommendations.
• Analyze traffic and PCAPs at protocol level to identify adversary techniques.
• Advise on FCI placement, coverage, and detection workflows within customer environments.
• Communicate findings to government and Trinity Cyber teams and capture feedback for product improvements.

Skills

Network traffic analysis

PCAP analysis

MITRE ATT&CK

SIEM (Splunk)

Threat intelligence OSINT

Clear communication

Tools

Splunk SIEM

YARA

Suricata

Snort

Sigma

Job description

Trinity Cyber is seeking a Resident Threat Operations Analyst to serve as the embedded technical authority for a major government customer. The role is on-site in the Washington, DC metro area and requires an active TS/SCI clearance.

You will advise customer cyber operations teams on maximizing FCI effectiveness, surface detection opportunities, and translate mission requirements into capabilities delivered by Trinity Cyber.