CSSP Threat Hunting Analyst, Junior

TekSynap•Fort Belvoir, VA

3d•Onsite

About The Position

The CSSP Threat Hunting Analyst, Jr., serves as a proactive cyber defense specialist within our Prime Contract supporting the Defense Threat Reduction Agency (DTRA). This role is dedicated to uncovering, identifying, and neutralizing hidden or advanced cyber threats that evade traditional signature-based detection mechanisms. By applying threat intelligence, formulating logical hunt hypotheses, and performing direct host and network analysis, the analyst strengthens the overall defense-in-depth posture of the DTRA CSSP and its subscriber networks in strict compliance with DoD operational guidelines.

Requirements

Active Top-Secret Clearance with SCI eligibility required.
DoD 8570/8140 IAT Level II
DoD 8570/8140 CSSP Analyst
Minimum 2 to 5 years of progressive experience in cybersecurity operations, threat hunting, or incident response with a Bachelor's degree (or 1 to 3 years with a Master's degree, or 0 to 1 years with a PhD).
Direct CSSP or SOC Experience is required.
BA/BS College degree.
U.S Citizenship Required

Responsibilities

Develop, test, and document proactive threat-hunting hypotheses to identify and neutralize threats before they cause damage.
Construct and execute hunts based on threat intelligence, behavioral anomalies, and detailed attack path analysis.
Dig through diverse telemetry datasets spanning cloud resources, identity systems, workloads, and network infrastructure.
Correlate disparate events across network and host endpoints to reconstruct complex adversary attack campaigns.
Collect and analyze network and host artifacts, including logs, system images, and packet captures.
Provide expert technical support and perform real-time cyber defense incident handling tasks (including forensic collections, intrusion tracking, and direct system remediation) in strict accordance with the DoD Instruction 8530.01 guidelines.
Create detection use cases based on current threat vectors, the MITRE ATT&CK framework, and Government direction.
Actively partner with engineering teams to automate these use cases, striving to keep false-positive rates below 10%.
Create threat-informed searches to find threat actor aligned malicious cyber activity.
Coordinate with Threat Detection Engineering to establish and enhance long term detection strategies.
Make technical recommendations for correlation rules, filters, signatures, and playbooks.
Track, validate, and provide monthly metrics on configuration refinement requests.
Leverage the CSSP Data Element Dictionary (DED) and Data Quality Scoring (DQS) parameters, such as Parsing Success Rate (PSR) and Field Completeness Score (FCS), to ensure hunting operations rely exclusively on high-fidelity, trusted telemetry.