Threat Hunt Lead - Proactive Cyber Defense & APT Analysis

cFocus Software Incorporated; Washington (District of Columbia); Hybrid; USD 140,000 - 170,000; Full time

Job summary

cFocus Software seeks a Threat Hunt Lead to join our program supporting AOUSC. The role is Hybrid with onsite in Washington, DC, and requires a Public Trust clearance.

You will lead threat hunting operations, develop execution plans, and collaborate across intelligence, detection engineering, and incident response teams to strengthen judiciary security. Ideal candidates bring 5+ years in IR, proficiency in tools like Splunk and Microsoft Sentinel, and a background in scripting

Qualifications

• B.S. Computer Science, Information Technology, or a related field.
• Active Public Trust clearance.
• 5+ years within IR in a large SOC with 3+ years on proactive threat hunting.
• 3+ years of hypothesis-driven data analysis for APT behavior.
• 2+ years scripting with Python and PowerShell to develop new tools.
• Active OSCP or GXPN certification.

Responsibilities

• Lead proactive threat hunting operations to identify APTs, insider threats, and anomalies.
• Develop and execute hypothesis-driven hunts using threat intelligence and TTPs.
• Coordinate hunt activities within Agile two‑week sprints; ensure completion of objectives.
• Develop Threat Hunt Execution Plans with hypotheses, telemetry, and procedures.
• Analyze endpoint, network, cloud, SIEM, EDR, and log telemetry for IOCs and attack patterns.
• Coordinate with Cybersecurity Triage and Incident Response teams per JSOCIRP.

Skills

Threat hunting

Python

PowerShell

Adversary emulation

Data analysis

Threat intelligence

Education

B.S. Computer Science / Information Technology or related field

OSCP or GXPN certification

Tools

Splunk

Microsoft Sentinel

Splunk SOAR

CrowdStrike

Qualys

ServiceNow

Jira

Job description

cFocus Software seeks a Threat Hunt Lead to join our program supporting AOUSC. The role is Hybrid with onsite in Washington, DC, and requires a Public Trust clearance.

You will lead threat hunting operations, develop execution plans, and collaborate across intelligence, detection engineering, and incident response teams to strengthen judiciary security. Ideal candidates bring 5+ years in IR, proficiency in tools like Splunk and Microsoft Sentinel, and a background in scripting