TS / SCI cleared Cyber Threat Analyst

ClearBridge Technology Group; Hawaii; On-site; USD 77,000 - 112,000; Full time

Job summary

ClearBridge Technology Group seeks six Cyber Threat Analysts with active TS/SCI clearance for a 12-month onsite engagement at Pearl Harbor, HI. You will join the Joint Fires Network SOC supporting a DoD enterprise with threat intelligence synthesis, anomaly detection and threat hunting across up to 30 nodes.

Responsibilities include analyzing network telemetry (NetFlow, proxies, PCAPs), correlating data in ELK, and developing containment and response playbooks in JIRA.

Qualifications

• Bachelor’s degree required; military experience acceptable if no degree.
• 4+ years in cyber threat intelligence, threat hunting, or SOC operations.
• Experience reconstructing intrusion paths from NetFlow, logs and PCAPs.
• Experience querying ELK (Elasticsearch/Logstash/Kibana) with KQL/Lucene.

Responsibilities

• Analyze network telemetry, NetFlow, proxies, and PCAPs to map intrusions.
• Develop threat hunting playbooks and containment/response strategies in JIRA.

Skills

Active TS/SCI clearance

Cyber Threat Intelligence experience

Threat hunting / SOC operations

Network telemetry analysis (NetFlow, P

ELK / Elastic Defend querying

MITRE ATT&CK framework understanding

Incident documentation in JIRA

DOD 8140.03 / DCWF 532 familiarity

Security certifications (CySA+, GIAC,/

Education

Bachelor's degree

Tools

Corelight

Darktrace

Elastic Defend / ELK

JIRA

Palo Alto ATP

Job description

Our client, a leading Government Systems Integrator, is in need of 6 TS / SCI cleared Cyber Threat Analysts for initial 12 month contracts onsite in Pearl Harbor, HI. The Cyber Threat Analysts will be supporting an enterprise DOD customer working as part of their JFN (Joint Fires Network) SOC team. The JFN team provides specialized threat intelligence synthesis, behavioral anomaly detection and advanced threat hunting to safeguard the customers multi-level classified enclaves. The Cyber Threat Analysts will be responsible for analyzing network telemetry, advanced sensor feeds (Corelight and Darktrace) and syslog audits across up to 30 active operational nodes (including SD-WAN transport fabrics), developing novel behavioral threat hunting playbooks, formulating containment and response strategies in JIRA, etc.

Required Skills

• Must have an active TS / SCI clearance.
• At least 4 years of experience working in Cyber Threat Intelligence, all-source cyber analysis, threat hunting or SOC tier 2 / tier 3 Operations and a Bachelors degree (military experience will suffice if candidates do not have a degree.
• Prior experience analyzing and correlating network protocol telemetry, NetFlow, proxy logs and raw packet captures to reconstruct complex intrusion paths.
• Experience querying SIEM platforms, specifically Elasticsearch, Logstash, Kibana (ELK) / Elastic Defend using KQL or Lucene query syntax.
• Understanding of adversary TTPs, threat actor attribution and operational mapping, ideally using the MITRE ATT&CK framework.
• Experience writing incident documentation, standard operating procedures and containment playbooks in JIRA.
• Must hold a valid certification or degree meeting DOD 8140.03 / DCWF Work Role Code 532 Cyber Defense Incident Responder (at the intermediate proficiency level) prior to being onsite.
• Any of the following certifications, CySA+, GIAC CGTI, EC-C CEH, CND, Security+, etc.

Preferred Or Nice To Have Skills

• Operational experience analyzing telemetry from Corelight (Zeek), Darktrace, MDR or Palo Alto Advanced Threat Prevention (ATP).
• Experience utilizing AI prompting tools (Gemini, Grok) to automate threat hunting data collection and indicator extraction.

ClearBridge Technology Group is an Equal Opportunity Employer. The expected hourly rate range for this role is $56-81 / hr. The posted range is an estimate, the actual compensation offer will be based on the candidate’s experience, skills, qualifications and will be in line with internal equity.