The Role
Analyze network telemetry, sensor feeds, and logs to identify adversary activity across classified DoD environments. Develop threat-hunting playbooks, tune Elastic SIEM detections, map TTPs to MITRE ATT&CK, document containment procedures, and support TS/SCI incident response and reporting. The role requires onsite SCIF work, operational shift coverage, briefings, and emergency escalation support.
Summary Generated by Built In
Job Summary - $10,000 sign-on bonus included (subject to a 12-month commitment)
Newberry Group is seeking an analytical, mission-driven Cyber Threat Analyst to join our customer’s defensive cyber operations team supporting the Joint Fires Network (JFN) Security Operations Center (SOC). Operating out of secure Sensitive Compartmented Information Facilities (SCIFs) at DISA Pacific (Ford Island, HI), this team provides specialized threat intelligence synthesis, behavioral anomaly detection, and advanced threat hunting to safeguard the JFN Impact Level 7 (IL-7) and multi-level classified enclaves supporting the Olympus Fires mission.
In this role, you will analyze network telemetry, advanced sensor feeds (such as Corelight and Darktrace), and syslog audits across up to 30 active operational nodes (including SD-WAN transport fabrics tied to the DISN and GMS). You will develop novel behavioral threat hunting playbooks, formulate containment and response strategies in JIRA, support the JFN Incident Response Plan, ensure DIA-aligned TS/SCI incident escalation compliance, and translate adversary tradecraft into detection logic for the Elastic Search / Elastic Defend SIEM platform.
Location
This is a full-time onsite role in Ford Island, HI. Telework is not permitted.
Relocation expenses may be eligible for up to $10,000 reimbursement in addition to the sign-on bonus.
Salary
$115,000 to $150,000 annually - depending on level of experience
Responsibilities and Duties
1. Advanced Threat Hunting & Novel Playbook Development
2. TS/SCI Incident Handling & Incident Response
Clearance & Citizenship
Newberry Group is a performance-driven government services and solutions firm that provides security compliance, program governance, consulting, and customized solutions for public sector clients nationwide.
The strength of our company is a direct reflection of our highly skilled and talented workforce.
Benefits and Perks
In addition to competitive wages, Newberry Group offers an outstanding benefit package. This includes medical coverage with three plan options, dental and vision coverage, personal time off, paid holidays, paid parental leave, telecommuting if available, retirement savings accounts (Pre-Tax and Roth), flexible and dependent care savings accounts, life insurance, long and short-term disability coverage, tuition and training reimbursement, employee assistance program, and more.
The Newberry Group, Inc. is an Equal Opportunity Employer – EEO/AA/Disability/Veterans.
Newberry Group is seeking an analytical, mission-driven Cyber Threat Analyst to join our customer’s defensive cyber operations team supporting the Joint Fires Network (JFN) Security Operations Center (SOC). Operating out of secure Sensitive Compartmented Information Facilities (SCIFs) at DISA Pacific (Ford Island, HI), this team provides specialized threat intelligence synthesis, behavioral anomaly detection, and advanced threat hunting to safeguard the JFN Impact Level 7 (IL-7) and multi-level classified enclaves supporting the Olympus Fires mission.
In this role, you will analyze network telemetry, advanced sensor feeds (such as Corelight and Darktrace), and syslog audits across up to 30 active operational nodes (including SD-WAN transport fabrics tied to the DISN and GMS). You will develop novel behavioral threat hunting playbooks, formulate containment and response strategies in JIRA, support the JFN Incident Response Plan, ensure DIA-aligned TS/SCI incident escalation compliance, and translate adversary tradecraft into detection logic for the Elastic Search / Elastic Defend SIEM platform.
Location
This is a full-time onsite role in Ford Island, HI. Telework is not permitted.
Relocation expenses may be eligible for up to $10,000 reimbursement in addition to the sign-on bonus.
Salary
$115,000 to $150,000 annually - depending on level of experience
Responsibilities and Duties
1. Advanced Threat Hunting & Novel Playbook Development
- Novel Playbook Authoring: Design, test, and operationalize novel threat hunting playbooks focused on behavioral anomalies, abnormal command and control (C2), lateral movement, and traffic pattern deviations across JFN transport nodes.
- Proactive Hypothesis Hunting: Formulate threat hypotheses based on all-source intelligence and observed indicators, interrogating the Elastic Search / Defend SIEM and raw network telemetry to uncover persistent, evasive adversary tradecraft.
- Routine Threat Containment: Leverage Atlassian JIRA to author, refine, and maintain standardized processes and playbooks for executing routine threat containment actions and defensive countermeasure coordination.
- MITRE ATT&CK Mapping: Map adversary tactics, techniques, and procedures (TTPs) targeting tactical fires and command-and-control networks to the MITRE ATT&CK® framework to identify visibility gaps and improve defensive posturing.
- SIEM Detection Tuning: Recommend and refine custom detection queries (Elastic KQL/EQL) and alert correlations within Elastic Defend to optimize detection accuracy and reduce false positives for the 24/7 watch cell.
2. TS/SCI Incident Handling & Incident Response
- Incident Response Architecture: Drive the technical threat intelligence and containment sections of the JFN Incident Response Plan in alignment with enterprise standards.
- DIA-Aligned TS/SCI Incident Reporting: Strictly enforce Defense Intelligence Agency (DIA) requirements for TS/SCI incident handling, ensuring all spills, unauthorized access attempts, system compromises, and operational anomalies are reported through authorized channels within mandated reporting windows.
- CSSP Alignment & Briefings: Support the delivery and maturity of four of the seven DoD Cybersecurity Service Provider (CSSP) core functions during Phase I standup, providing actionable threat summaries, warnings, and intelligence briefings to JFN leadership, DISA, and mission stakeholders.
Clearance & Citizenship
- Citizenship: Must be a U.S. Citizen.
- Security Clearance: Must possess an active Top Secret clearance with current SCI eligibility (adjudicated Tier 5 / SSBI) prior to start date, with the ability to maintain clearance while working in a secure SCIF environment.
- Level II (Intermediate): Bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or related discipline and 2+ years of direct experience in cyber threat intelligence, all-source cyber analysis, threat hunting, or SOC tier-2/tier-3 operations; OR an Associate degree and 4+ years; OR 6+ years of relevant professional/military cyber intelligence experience in lieu of a degree.
- Level III (Senior): Bachelor’s degree in a technical discipline and 4+ years of relevant experience; OR an Associate degree and 6+ years; OR 8+ years of relevant experience/military service in lieu of degree.
- Must hold a valid certification or degree meeting DoD 8140.03 / DCWF Work Role Code 531 Cyber Defense Incident Responder at the Intermediate Proficiency Level prior to hire.
- Accepted Certifications include: CySA+, GIAC GCTI, EC-C CEH or CND, Security+ CE, GIAC GSEC, or higher (e.g., CASP+ CE, CISSP, GCIA, GCIH).
- Strong experience in threat hunting, cyber threat intelligence, or advanced incident analysis within a DoD, military, or government SOC/DCO environment.
- Proven ability to analyze and correlate network protocol telemetry, Netflow, proxy logs, and raw packet captures to reconstruct complex intrusion paths.
- Hands-on proficiency querying SIEM platforms—specifically Elasticsearch, Logstash, Kibana (ELK) / Elastic Defend—using KQL or Lucene query syntax.
- Deep knowledge of adversary TTPs, threat actor attribution, and operational mapping using the MITRE ATT&CK framework.
- Direct experience writing incident documentation, standard operating procedures, and containment playbooks in JIRA.
- Ability to work standard operational shifts with readiness for on-call surge or emergency incident escalation.
- Prior experience supporting C4ISR systems or tactical operational enclaves (e.g., PMN).
- Operational experience analyzing telemetry from Corelight (Zeek), Darktrace MDR, or Palo Alto Advanced Threat Prevention (ATP).
- Experience utilizing AI prompting tools (Gemini, Grok, ChatGPT) to automate threat hunting data collection and indicator extraction.
- Career Growth & Certification Support: Access Leidos cyber training pipelines, tuition assistance, and corporate sponsorships for premier technical credentials (SANS/GIAC, cloud security).
- Long-Term Program Backing: Solidified role on a high-priority joint program supporting strategic defense requirements across DISA.
Newberry Group is a performance-driven government services and solutions firm that provides security compliance, program governance, consulting, and customized solutions for public sector clients nationwide.
The strength of our company is a direct reflection of our highly skilled and talented workforce.
Benefits and Perks
In addition to competitive wages, Newberry Group offers an outstanding benefit package. This includes medical coverage with three plan options, dental and vision coverage, personal time off, paid holidays, paid parental leave, telecommuting if available, retirement savings accounts (Pre-Tax and Roth), flexible and dependent care savings accounts, life insurance, long and short-term disability coverage, tuition and training reimbursement, employee assistance program, and more.
The Newberry Group, Inc. is an Equal Opportunity Employer – EEO/AA/Disability/Veterans.
Skills Required
- U.S. citizenship
- Active Top Secret clearance with current SCI eligibility before the start date
- Bachelor's degree in cybersecurity, intelligence studies, computer science, information technology, or a related discipline, plus 2 or more years of relevant experience; equivalent associate degree or professional/military experience alternatives accepted
- DoD 8140.03/DCWF Work Role Code 531 Cyber Defense Incident Responder qualification at the Intermediate Proficiency Level
- Accepted baseline certification such as CySA+, GIAC GCTI, CEH, CND, Security+ CE, GSEC, CASP+ CE, CISSP, GCIA, or GCIH
- Experience in threat hunting, cyber threat intelligence, advanced incident analysis, or SOC Tier 2/Tier 3 operations within a DoD, military, or government environment
- Ability to analyze network protocol telemetry, NetFlow, proxy logs, and packet captures
- Hands-on experience with Elasticsearch, Logstash, Kibana, Elastic Defend, and KQL or Lucene query syntax
- Knowledge of adversary TTPs, threat actor attribution, and MITRE ATT&CK mapping
- Experience writing incident documentation, standard operating procedures, and containment playbooks in JIRA
- Ability to work operational shifts and support on-call or emergency incident escalation
- Experience supporting C4ISR systems or tactical operational enclaves
- Experience with Corelight/Zeek, Darktrace MDR, or Palo Alto Advanced Threat Prevention
- Experience using Gemini, Grok, ChatGPT, or similar AI prompting tools for threat-hunting data collection and indicator extraction
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Established in 1996, Newberry Group has set out to create something altogether different: meeting the most challenging needs of both Public and Private Sector clients. We achieve this by providing superior services and exceptionally qualified professionals who create a unique experience for our clients in every engagement. Newberry brings strength to our client from the inside out through client intimacy and superior quality, presence and accountability in our relationships, and cross-sector leverage of public and commercial sector best practices.
