On-Site Threat Operations Analyst (TS/SCI)

Trinity Cyber; Washington (District of Columbia); On-site; USD 120,000 - 160,000; Full time

Job summary

Trinity Cyber is seeking a Resident Threat Operations Analyst to be the embedded technical authority for a major government customer. You will be on-site in the Washington, DC metro area, advising threat operations teams and translating mission requirements into FCI capabilities.

The role requires an active TS/SCI clearance, deep knowledge of threat intelligence, protocol analysis, and network detection, and the ability to drive detection engineering and customer engagements in a classified

Qualifications

• Active TS/SCI clearance.
• Local to the Washington, DC metro area, on-site at the customer location.
• Experience as a SOC analyst, threat hunter, or incident responder with strong adversary-tradecraft knowledge.
• Hands-on experience developing or operationalizing network detection technology in production environments.
• Experience in classified government environments.
• Ability to rapidly learn complex cybersecurity technologies and become a trusted technical authority.

Responsibilities

• Translate customer threat intel into FCI countermeasures and COA recommendations.
• Study adversary TTPs and analyze traffic at the protocol level to counter threats at scale.
• Advise on FCI placement, coverage, and blind spots within customer networks and workflows.
• Communicate technical findings to government and Trinity Cyber teams and capture requirements for future FCI capabilities.

Skills

Threat intelligence research

Protocol analysis

Threat hunting

Incident response

Detection engineering

Technical authority

Communication skills

OSINT research

Rapid learning

Tools

YARA

Suricata

Snort

Sigma

Wireshark

Splunk

Job description

Trinity Cyber is seeking a Resident Threat Operations Analyst to be the embedded technical authority for a major government customer. You will be on-site in the Washington, DC metro area, advising threat operations teams and translating mission requirements into FCI capabilities.

The role requires an active TS/SCI clearance, deep knowledge of threat intelligence, protocol analysis, and network detection, and the ability to drive detection engineering and customer engagements in a classified