AOUSC - CTI Lead

cFocus Software Incorporated•Washington, DC

3d•Hybrid

About The Position

cFocus Software is seeking a CTI Lead to join their program supporting the Administrative Office of the United States Courts (AOUSC). This is a Hybrid position located in Washington, DC, requiring a Public Trust clearance. The role involves leading Cyber Threat Intelligence operations to support the AOUSC Security Operations Division (SOD) mission and 24x7x365 cybersecurity operations. The lead will proactively identify, analyze, and operationalize cyber threat intelligence, conduct advanced analysis of cyber threats, develop intelligence-driven assessments, and coordinate intelligence support for cybersecurity incidents. Responsibilities include responding to CTI support requests, developing the Cyber Threat Intelligence Execution Plan, correlating indicators of compromise, performing proactive intelligence analysis, and developing various intelligence reports for different audiences. The role also involves collaborating with Threat Hunting and Detection Engineering teams, supporting threat models, utilizing various cybersecurity tools, preparing and presenting technical briefings, maintaining documentation, and providing mentorship to CTI analysts.

Requirements

Active Public Trust clearance
B.S. Computer Science, Information Technology, or a related field
5+ years’ experience in conducting in-depth technical analysis of cyber threats, including malware, phishing campaigns, and other attack vectors.
5+ years’ experience in collecting and aggregating threat intelligence from various sources, such as opensource intelligence (OSINT), dark web forums, and commercial threat intelligence feeds. This includes evaluating the credibility and relevance of intelligence sources and identifying actionable intelligence for the organization.
5+ years’ experience in producing written and oral reports, briefings, and presentations to communicate threat intelligence findings, assessments, and recommendations to stakeholders (executives).
5+ years’ experience using cybersecurity tools and technologies for threat intelligence analysis, such as threat intelligence platforms (TIPs), SIEM systems, and malware analysis tools.
Active GCTI or relevant vendor Cyber Threat Intelligence certification, such as Mandiant Cyber Threat Intelligence Analysis Certification

Responsibilities

Lead Cyber Threat Intelligence operations supporting AOUSC Security Operations Division (SOD) mission objectives and 24x7x365 cybersecurity operations.
Proactively identify, analyze, and operationalize cyber threat intelligence using external intelligence feeds, federal partner reporting, open-source intelligence (OSINT), vendor intelligence platforms, and internal telemetry.
Conduct advanced analysis of cyber threat actors, campaigns, malware, phishing activity, suspicious infrastructure, and adversary TTPs impacting Judiciary systems and networks.
Develop intelligence-driven assessments regarding emerging threats, attack trends, vulnerabilities, and cyber risks affecting Judiciary operations.
Coordinate intelligence support for active cybersecurity incidents and provide actionable intelligence products to Incident Response (IR), Cybersecurity Triage, Threat Hunting, and Detection Engineering teams.
Respond to and resolve CTI support requests from Security Operations teams within established Service Level Agreements (SLAs).
Develop and maintain the Cyber Threat Intelligence Execution Plan aligned to identified threat vectors, organizational risk, and government priorities.
Correlate indicators of compromise (IOCs), attack patterns, adversary infrastructure, and telemetry to identify malicious activity and support operational decision-making.
Perform proactive intelligence analysis to identify potential threats and suspicious activity within Judiciary systems, networks, and cloud environments.
Develop Tactical Threat Intelligence Reports supporting ongoing cybersecurity investigations, incident response operations, and executive awareness.
Produce detailed CTI Reports containing analysis of patterns, trends, indicators, vulnerabilities, adversary methodologies, and recommendations for improved detections and defensive actions.
Develop executive-level CTI Sprint Reports summarizing threat activity, intelligence findings, operational impacts, emerging risks, and strategic recommendations.
Provide recommendations regarding changes to risk levels for Judiciary systems based on vulnerabilities, emerging threats, intelligence reporting, and active exploitation activity.
Collaborate closely with Threat Hunting and Detection Engineering teams to improve telemetry coverage, detection logic, logging visibility, and threat detection capabilities.
Support development and operationalization of intelligence-driven threat models and risk assessments tailored to Judiciary environments and high-value assets.
Perform intelligence analysis utilizing Splunk Enterprise Security, Microsoft Sentinel, Splunk SOAR, CrowdStrike, Qualys, ServiceNow, Jira, Recorded Future, Google Threat Intelligence, Cisco Threat Grid, and related cybersecurity tools.
Prepare and present technical briefings, operational updates, intelligence reports, and executive presentations to AO leadership and federal stakeholders.
Maintain documentation, standard operating procedures (SOPs), intelligence methodologies, and operational processes in accordance with AO standards and NIST guidance.
Provide mentorship, technical guidance, and quality oversight to CTI analysts and supporting cybersecurity personnel.
Support transition-in, transition-out, operational readiness, and knowledge transfer activities in accordance with AO requirements.