Threat Hunt Lead
No salary listed
Senior
Bachelor's
Washington, DC, USA
HybridHybrid role with on-site work in Washington, DC.
CybersecuritySecurity Operations & Incident Response
No H1B Sponsorship
US Top Secret Clearance Required
About the job
Requirements
- Active Public Trust clearance.
- Bachelor of Science degree in Computer Science, Information Technology, or a related field.
- At least 5 years of incident response experience in a large security operations center with more than 5,000 endpoints, including at least 3 years focused on proactive threat hunting or adversary emulation.
- At least 3 years of experience forming hypotheses, querying large datasets, and identifying advanced persistent threat behavior.
- At least 2 years of experience using scripting languages including Python and PowerShell to develop new tools.
- Active Offensive Security Certified Professional or GIAC Exploit Researcher and Advanced Penetration Tester certification.
Responsibilities
- Lead proactive threat hunting operations to identify advanced persistent threats, insider threats, malicious activity, and anomalous behaviors that evade traditional security controls.
- Develop and execute hypothesis-driven threat hunts using threat intelligence, adversary tactics, techniques, and procedures, behavioral analytics, and anomalous telemetry.
- Coordinate threat hunt activities within Agile two-week sprint cycles and ensure execution of assigned hunt objectives and deliverables.
- Develop Threat Hunt Execution Plans defining hunt hypotheses, objectives, technical methodologies, required telemetry, and investigative procedures.
- Analyze endpoint, network, cloud, identity, security information and event management, endpoint detection and response, and log telemetry to identify indicators of compromise, suspicious activity, and attack patterns.
- Coordinate and escalate confirmed or suspected findings to Cybersecurity Triage and Incident Response teams in accordance with the Judiciary SOC Incident Response Plan.
- Collaborate with Detection Engineering teams to identify and remediate logging, telemetry, detection, and visibility gaps discovered during threat hunting operations.
- Work with Cyber Threat Intelligence teams to operationalize intelligence, enrich investigations, and identify emerging threats impacting the Judiciary.
- Conduct advanced analysis of threat actor behaviors, malware campaigns, phishing activity, suspicious infrastructure, and attack trends.
- Develop detailed Threat Hunt Reports documenting hunt objectives, findings, tactics, techniques, and procedures, queries used, telemetry gaps, identified risks, and recommendations for improved detections.
- Produce executive-level Hunt Sprint Reports summarizing hunt activities, operational impacts, recommendations, and emerging cybersecurity risks.
- Provide real-time investigative support during cybersecurity incidents and high-priority threat investigations.
- Perform analysis using Splunk Enterprise Security, Microsoft Sentinel, Splunk SOAR, CrowdStrike, Qualys, ServiceNow, Jira, and other approved security platforms.
- Support development and refinement of threat models tailored to Judiciary systems, high-value assets, and mission-critical environments.
- Develop and maintain threat hunting standard operating procedures, playbooks, technical procedures, and investigative methodologies aligned with Administrative Office and federal cybersecurity standards.
- Support enterprise security awareness initiatives through threat briefings, technical reporting, and operational presentations.
- Participate in weekly technical meetings, operational reviews, and status briefings with Administrative Office leadership and federal stakeholders.
- Provide mentorship, technical guidance, and quality oversight to threat hunters and supporting analysts.
- Support transition-in and transition-out activities, operational readiness, documentation development, and knowledge transfer activities.
- Drive continuous improvement initiatives focused on detection coverage, telemetry enrichment, operational efficiency, and threat hunting maturity.
About the company
cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It helps agencies design, implement, and manage security architectures, cross-domain data workflows, and geospatial solutions through consulting, implementation, and ongoing support. It differentiates itself with 18+ years of federal-focused experience and deep domain knowledge in government cybersecurity and geospatial work. Its goal is to help federal agencies protect operations, comply with regulations, and optimize IT and geospatial capabilities for secure, efficient government services.
Company Size
11-50
Company Stage
N/A
Total Funding
N/A
Headquarters
Largo, Florida
Founded
2006
Get referred to cFocus Software
See people who can refer or advise you
Simplify's Take
What believers are saying
- DHS won its geospatial protest on July 29, 2026, validating cFocus's award.
- GAO denied the NIH emergency call center protest, confirming competitive strength.
- CMMC Level 2 and renewed ISO certifications on July 11 and July 16, 2025 strengthen bids.
What critics are saying
- HUD OCIO POG 4 task order expires September 29, 2026, risking $3.7 million.
- DFC cyber BPA ends September 23, 2026, shrinking recurring revenue visibility.
- Dependence on federal recompetes invites displacement by larger integrators and cloud specialists.
What makes cFocus Software unique
- Microsoft Gold Certified Partner with FedRAMP automation and Azure Government focus.
- Exclusive ATO as a Service branding distinguishes cFocus in federal cloud compliance.
- Small-business SDB status helps win set-aside federal IT work.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Remote Work Options