cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

Cyber Threat Hunter

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeWashington, DC, USANo salary listed

About the Job

Requirements

At least 5 years of experience performing threat hunts and incident response activities in cloud-based and non-cloud-based environments, including Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Zscaler.
At least 5 years of experience performing hypothesis-based threat hunting and incident response using Splunk Enterprise Security.
At least 5 years of experience using Splunk to create queries and lookup tables.
At least 5 years of experience collecting and analyzing data from compromised systems using endpoint detection and response agents such as CrowdStrike and custom scripts such as Sysmon and Auditd.
At least 5 years of experience with Microsoft Sentinel for threat hunting within Microsoft Azure; Tenable Nessus and SYN/ACK for vulnerability management; NetScout for analyzing network traffic flow; SPUR.us address enrichment; and Mandiant threat intelligence feeds.
Must work onsite at the AOUSC office in Washington, DC, Monday through Thursday (80%).

Responsibilities

Provide incident response services after an incident is declared and proactively search for security incidents that automated alerting would not normally detect.
Explore datasets across the judicial fabric to identify unique anomalies that may indicate threat actor activity, assuming the adversary is already present in the judicial fabric.
Accept and respond to government technical requests through the AOUSC ITSM ticketing system, such as HEAT or ServiceNow, for threat hunt support involving cloud-based and non-cloud-based applications, including Microsoft Azure, Microsoft O365, Microsoft Active Directory, and cloud access security brokers such as Zscaler.
Review and analyze risk-based security information and event management alerts when developing hunt hypotheses.
Review open-source intelligence about threat actors when developing hunt hypotheses.
Plan, conduct, and document iterative, hypothesis-based tactics, techniques, and procedures hunts using the agile scrum project management methodology.
At the conclusion of each hunt, propose, discuss, and document custom searches for automated detection of threat actor activity based on the hunt hypothesis.
Configure, deploy, and troubleshoot endpoint detection and response agents such as CrowdStrike and Sysmon.
Collect and analyze data from compromised systems using endpoint detection and response agents and custom scripts provided by the AOUSC.
Track and document cyber defense incidents from initial detection through final resolution.
Interface with IT contacts at courts or vendors to install or diagnose problems with endpoint detection and response agents.
Participate in government-led after-action reviews of incidents.
Triage malware events to identify the root cause of specific activity.
Attend daily agile scrum standups and report progress on assigned Jira stories.
Produce hunt hypotheses that describe how an actor might operate in the network while remaining undetected, including expected outcomes if the hypothesis is true or false, and submit complete, accurate deliverables within the specified times.
Produce hunt reports describing the original hypothesis and all iterations, including how each hypothesis was tested and the results; submit complete, accurate deliverables within the specified times.
Document and test detection logic for automated detection of threat actor activity based on hunt hypotheses, using Splunk Enterprise Security searches run at proposed intervals; propose and discuss the searches in agile scrum standups and document them in Jira stories.
Provide timely advanced subject matter expert incident response support for Priority 1 security events, actively participating in incident response activities within four hours of request, 24 hours a day, 7 days a week, 365 days a year.
Document all incident details in an incident report, including an executive summary, incident details, security impact, timeline, and actions taken.
Provide weekly reports to the AOUSC Program Manager documenting all activities, tasks, tickets, and documents worked on.
Document repeatable standard operating procedures and playbooks for security use cases.

Desired Qualifications

One of the following certifications: GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), GIAC Continuous Monitoring (GMON), GIAC Defending Advanced Threats (GDAT), or Splunk Core Power User.

cFocus Software seeks a Mid Level Cyber Threat Hunter to join our program supporting US Courts in Washington, DC. This position is 4 days a week onsite in DC and one day remote.

Required Qualifications include:

5+ years of experience performing threat hunts & incident response activities for cloud-based and non-cloud-based environments, such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Zscaler
5+ years of experience performing hypothesis-based threat hunt & incident response utilizing Splunk Enterprise Security.
5+ years of using Splunk to create queries and look up tables.
5+ years of experience collecting and analyzing data from compromised systems using EDR agents (e.g. CrowdStrike) and custom scripts (e.g. Sysmon & Auditd)
5+ years of experience with the following threat hunting tools:
- Microsoft Sentinel for threat hunting within Microsoft Azure;
- Tenable Nessus and SYN/ACK for vulnerability management;
- NetScout for analyzing network traffic flow;
- SPUR.us enrichment of addresses
- Mandiant Threat intel feeds
Must be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC

Desired Qualifications include:

One of the following certifications:
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Certified Incident Handler (GCIH)
- GIAC Continuous Monitoring (GMON)
- GIAC Defending Advanced Threats (GDAT)
- Splunk Core Power User

Duties:

Provide incident response services after an incident is declared and provides a service that proactively searches for security incidents that would not normally be detected through automated alerting.
The Threat Hunt mission is to explore datasets across the judicial fabric to identify unique anomalies that may be indicative of threat actor activity based on the assumption that the adversary is already present in the judicial fabric.
Accept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now), for threat hunt support. Threat hunt targets include cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (i.e., Zscaler).
Review and analyze risk-based Security information and event management (SIEM) alerts when developing hunt hypotheses.
Review open-source intelligence about threat actors when developing hunt hypotheses.
Plan, conduct, and document iterative, hypothesis based, tactics, techniques, and procedures (TTP) hunts utilizing the agile scrum project management methodology.
At the conclusion of each hunt, propose, discuss, and document custom searches for automated detection of threat actor activity based on the hunt hypothesis.
Configure, deploy, and troubleshoot Endpoint Detection and Response agents (e.g., CrowdStrike and Sysmon).
Collect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.
Track and document cyber defense incidents from initial detection through final resolution.
Interface with IT contacts at court or vendor to install or diagnose problems with EDR agents.
Participate in government led after action reviews of incidents.
Triage malware events to identify the root cause of specific activity.
Attend daily Agile Scrum standups and report progress on assigned Jira stories.

Deliverables:

Hunt Hypotheses: Hunt hypotheses describe how an actor might operate in the network while remaining undetected. The hypothesis describes what is expected to happen if the hypothesis is true and what is expected to happen if the hypothesis is false. The hypothesis contains all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section.
Hunt Reports: Hunt reports describe the original hypothesis and all iterations. At each stage, the report details how the hypothesis was tested and the results. The reports contain all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section.
Detection Logic: Document and test detection logic for automated detection of threat actor activity based on hunt hypothesis. Detection logic in the form of Splunk Enterprise Security (ES) searches that are run at proposed intervals. Proposal and discussion will happen in agile scrum stand up meetings. Document in Jira stories.
Advanced SME IR Reports: Timely Advanced SME IR Support for Priority 1 Security Events. SME actively participating in IR activities within 4 hours of request (7x24x365).
Incident Report: Document all incident details in an incident report. Report shall include executive summary, details of incident, security impact of incident, timeline of incident, and actions taken.
Provide Weekly Reports to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on.
Document repeatable Standard Operation Procedures (SOPs) and playbooks for security use cases.

About the Company

cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It designs and manages security architectures, conducts risk assessments, ensures compliance, and delivers IT and geospatial data solutions tailored to federal requirements. The company differentiates itself through 18+ years of government-focused experience across dozens of agencies and established, government-facing delivery processes. Its goal is to help federal agencies protect, operate, and optimize their IT and geospatial capabilities for secure and compliant government operations.

Company size: 11-50
Company stage: Not listed
Total funding: Not listed
Headquarters: Largo, FL
Founded: 2006

Recently Posted Jobs

Explore more opportunities at cFocus Software

See more jobs