Threat Hunter: DoD Cyber Defense & CTI Expert

STOPSO; Fayetteville (NC); On-site; USD 110,000 - 160,000; Full time

Job summary

STOPSO seeks a Threat Hunter to support the USARC DCOMSS program at Fort Bragg, North Carolina. You will hunt adversaries using hypotheses, telemetry, and CTI data to develop detections for blue team operations.

Responsibilities include validating detections, documenting data sources and actions, and coordinating with CTI and exercise personnel. Active TS/SCI clearance is required for this mission.

Qualifications

• Minimum 3 years of documented relevant threat hunting, intrusion analysis, and CTI integration experience.
• DCWF 511 Advanced and DCWF 171 Intermediate proficiencies required per DoD guidelines.
• DoD 8140.03 qualification requirements must be met for every assigned work role.

Responsibilities

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escalate as needed.
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with responsibilities, clearance, and scope.

Skills

Threat hunting

CTI integration

MITRE ATTĒCK

SIEM analysis

EDR analysis

Threat intelligence

NetFlow

YARA

Education

DCWF 511 Advanced proficiency

DCWF 171 Intermediate proficiency

DoD 8140.03 qualification requirements

Tools

CBROPS

CFR

CySA+

GCFA

GCIA

GICSP

Job description

STOPSO seeks a Threat Hunter to support the USARC DCOMSS program at Fort Bragg, North Carolina. You will hunt adversaries using hypotheses, telemetry, and CTI data to develop detections for blue team operations.

Responsibilities include validating detections, documenting data sources and actions, and coordinating with CTI and exercise personnel. Active TS/SCI clearance is required for this mission.