Be an Early Applicant
The Role
Lead CTI, detection engineering, and threat hunting operations. Develop intelligence-driven detections, hunt playbooks, SIEM/analytics content, and SOAR integrations. Conduct hypothesis-based hunts aligned to MITRE ATT&CK, analyze malware and adversary campaigns, produce threat intelligence reporting, and brief executives on emerging threats and operational risk.
Summary Generated by Built In
Position Title
Cyber Threat Intelligence & Threat Hunting Lead
Position Overview
The Cyber Threat Intelligence & Threat Hunting Lead will oversee integrated cyber threat intelligence (CTI), detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions.
The Lead will drive development of intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities.
Key Responsibilities
Cyber Threat Intelligence & Threat Hunting Lead
Position Overview
The Cyber Threat Intelligence & Threat Hunting Lead will oversee integrated cyber threat intelligence (CTI), detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions.
The Lead will drive development of intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities.
Key Responsibilities
- Lead CTI, detection engineering, and threat hunting operations.
- Develop intelligence-driven detection and hunt strategies.
- Produce operational and strategic threat intelligence reporting.
- Develop and maintain:
- SIEM detections,
- analytics,
- correlation rules,
- behavioral detections,
- and hunt playbooks.
- Conduct hypothesis-based threat hunting aligned to:
- MITRE ATT&CK,
- adversary TTPs,
- malware campaigns,
- and emerging threats.
- Integrate CTI into SOC workflows, detection engineering, and incident response operations.
- Analyze:
- malware trends,
- adversary infrastructure,
- campaigns,
- indicators,
- and attack patterns.
- Support automation and SOAR integration initiatives.
- Brief executives and technical leadership on emerging threats and operational risk.
- 10+ years of cybersecurity operations experience.
- 5+ years supporting CTI, threat hunting, or detection engineering programs.
- Experience with:
- Splunk,
- Sentinel,
- CrowdStrike,
- EDR telemetry,
- detection content engineering,
- and intelligence platforms.
- Strong understanding of:
- MITRE ATT&CK,
- adversary tradecraft,
- malware analysis,
- and intelligence analysis methodologies.
- Experience developing:
- SIEM detections,
- hunt analytics,
- detection tuning,
- and operational reporting.
- GCTI
- GCFA
- GCIH
- GMON
- GCDA
- CISSP
- Splunk Security certifications
Skills Required
- 10+ years of cybersecurity operations experience
- 5+ years supporting CTI, threat hunting, or detection engineering programs
- Experience with Splunk
- Experience with Microsoft Sentinel
- Experience with CrowdStrike
- Experience with EDR telemetry
- Experience with detection content engineering
- Experience with intelligence platforms
- Strong understanding of MITRE ATT&CK
- Strong understanding of adversary tradecraft
- Strong understanding of malware analysis
- Strong understanding of intelligence analysis methodologies
- Experience developing SIEM detections, hunt analytics, detection tuning, and operational reporting
- Support automation and SOAR integration initiatives
- Ability to brief executives and technical leadership on emerging threats and operational risk
- GCTI
- GCFA
- GCIH
- GMON
- GCDA
- CISSP
- Splunk Security certifications
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 2006, cFocus Software automates FedRAMP compliance and develops government chatbots for the Azure Government Cloud, Office 365, and SharePoint. cFocus Software is the exclusive vendor of ATO (Authority To Operate) as a Service™, which automates FedRAMP compliance for the Azure Government Cloud and Office 365. Contact Us for a demo of ATO as a Service™ or a FREE government chatbot proof of concept project today!
