Threat Hunter

STOPSO; Fayetteville (NC); On-site; USD 110,000 - 160,000; Full time

Job summary

STOPSO seeks a Threat Hunter to support the USARC DCOMSS program at Fort Bragg, North Carolina. You will hunt adversaries using hypotheses, telemetry, and CTI data to develop detections for blue team operations.

Responsibilities include validating detections, documenting data sources and actions, and coordinating with CTI and exercise personnel. Active TS/SCI clearance is required for this mission.

Qualifications

• Minimum 3 years of documented relevant threat hunting, intrusion analysis, and CTI integration experience.
• DCWF 511 Advanced and DCWF 171 Intermediate proficiencies required per DoD guidelines.
• DoD 8140.03 qualification requirements must be met for every assigned work role.

Responsibilities

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escalate as needed.
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with responsibilities, clearance, and scope.

Skills

Threat hunting

CTI integration

MITRE ATTĒCK

SIEM analysis

EDR analysis

Threat intelligence

NetFlow

YARA

Education

DCWF 511 Advanced proficiency

DCWF 171 Intermediate proficiency

DoD 8140.03 qualification requirements

Tools

CBROPS

CFR

CySA+

GCFA

GCIA

GICSP

Job description

Position Summary

Strategic Operational Solutions (STOPSO) is seeking a Threat Hunter to support the U.S. Army Reserve Command (USARC) Defensive Cyberspace Operations Mission Support Services (DCOMSS) program at Fort Bragg, North Carolina. Find adversary activity through hypothesis-driven hunts that combine defensive telemetry and cyber threat intelligence. The Threat Hunter develops findings and detection improvements for Blue Team and CTI operations.

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and observed telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escal…
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, methods, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.

Position Summary

Strategic Operational Solutions (STOPSO) is seeking a Threat Hunter to support the U.S. Army Reserve Command (USARC) Defensive Cyberspace Operations Mission Support Services (DCOMSS) program at Fort Bragg, North Carolina. Find adversary activity through hypothesis-driven hunts that combine defensive telemetry and cyber threat intelligence. The Threat Hunter develops findings and detection improvements for Blue Team and CTI operations.

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and observed telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escal…
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, methods, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.

Essential Duties And Responsibilities

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and observed telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escal…
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, methods, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.

Required Qualifications

• Minimum 3 years of documented relevant experience. Relevant threat hunting, intrusion analysis, detection development, SIEM/network analysis, and CTI integration experience.
• DoD Cyber Workforce Framework (DCWF) 511, Cyber Defense Analyst, Advanced proficiency, and DCWF 171, Cyber Threat Intelligence Analyst, Intermediate proficiency.
• Meet DoDM 8140.03 qualification requirements for every assigned work role and proficiency through an approved education, training, certification, or authorized experience route before independent cyber work. Document work-role appointment and qualification; maintain required residential qualification and continuing learning. A higher-level approved option may qualify the same role at a lower level.
• Current matrix-listed certification options for 511 Advanced: CBROPS, CFR, CySA+, GCFA, GCIA, GICSP. The additional 171 Intermediate intelligence qualification must be verified under the Government-approved criteria.

Knowledge, Skills And Abilities

• Demonstrated knowledge of Threat hunting, intrusion analysis, MITRE ATT&CK, adversary TTPs, cyber threat intelligence, and detection engineering.
• Proficiency with SIEM, EDR, NetFlow, packet capture, YARA, Snort or Suricata, and host telemetry appropriate to assigned duties and approved access.
• Ability to produce accurate records, explain findings and decisions, and follow approved procedures and security requirements.
• Strong written and verbal communication skills and sound judgment when coordinating with technical staff and Government stakeholders.
• Strong organizational skills, confidentiality, and ability to work independently and collaboratively in a mission-focused environment.

Preferred Qualifications

• Experience hunting across classified DoD cyber defense environments.
• Relevant DoD or enterprise IT experience with mission tooling and operational reporting.

Security Clearance

Active TS/SCI clearance and ability to maintain required SCI indoctrination and assigned system access. U.S. citizenship is required.

Supervisory Responsibilities

No formal supervisory responsibilities; provides technical findings and detection guidance.

Work Environment And Physical Requirements

Work is primarily performed on site in a secure Government facility using computer systems and standard office equipment. The employee must be able to perform sustained computer-based analysis or coordination, communicate effectively, and support operational activities outside standard business hours when assigned. Mission-essential watch roles may include shifts, weekends, and holidays.

Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions of the position.

Travel

Occasional local, CONUS, or OCONUS travel may be required for authorized mission activities, exercises, assessments, or conferences.

Equal Employment Opportunity

STOPSO is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, disability, veteran status, genetic information, or any other characteristic protected by applicable federal, state, or local law.