Cyber Threat Analyst (TN22)

The Newberry Group•Cross Hill, SC

1d•$115,000 - $150,000•Onsite

About The Position

Newberry Group is seeking an experienced Cyber Threat Analyst to join its customer’s Defensive Cyber Operations team supporting the Defense Information Systems Agency Pacific at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role supports the Global Services Management – Operations II Task Order 22 Boundary Cyber Defense and Cybersecurity Services Provider contract, defending the Department of Defense Information Network, U.S. Pacific Command, and critical mission partner enclaves against advanced persistent threats and nation-state cyber actors. The analyst synthesizes multi-source intelligence, telemetry, and forensic data into actionable threat intelligence. The position analyzes adversary tactics, techniques, and procedures; develops threat indicators; tracks adversary campaigns; and informs threat-driven defense operations across perimeter boundaries, multi-cloud platforms, and classified networks, from Unclassified and Secret environments up to Top Secret/SCI. This is a full-time, onsite position in Ford Island, Hawaii; telework is not permitted. The role requires an active DoD Top Secret clearance with SCI eligibility, although Secret clearance may be acceptable with Government approval. Travel is required approximately 10% of the time. Relocation expenses may be eligible for reimbursement up to $10,000. A $10,000 sign-on bonus is available subject to a 12-month commitment. The stated annual salary range is $115,000 to $150,000, depending on experience and position level.

Requirements

For Level II: Bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or a related discipline and 2+ years of direct cyber threat intelligence, all-source cyber analysis, or CND experience; alternatively, an associate degree and 4+ years of experience, or 6+ years of relevant professional/military cyber intelligence experience in lieu of a degree.
For Level III: Bachelor’s degree and 4+ years of relevant experience; alternatively, an associate degree and 6+ years of experience, or 8+ years of relevant experience/military service in lieu of a degree.
Hold, before the start date, a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent at Intermediate proficiency level. Listed certifications include CompTIA CySA+, GCTI, CEH, CFR, GCIA, GCIH, CND, CISSP, CASP+ CE, and GCFA.
Active DoD Top Secret clearance with SCI eligibility; Secret clearance may be acceptable with Government approval.
Willingness to obtain and maintain system access credentials required by operational mission requirements.
In-depth knowledge of adversary TTPs, threat actor attribution, and mapping adversary activity to MITRE ATT&CK.
Ability to author structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.
Ability to analyze packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct intrusions.
Hands-on familiarity querying enterprise SIEM platforms, including Splunk SPL, Elastic/Kibana, and Microsoft Sentinel KQL.
Working knowledge of threat intelligence platforms and tools such as MISP, ThreatConnect, Anomali, VirusTotal, and Shodan.
Willingness and ability to work standard operational shifts, with occasional surge or after-hours support during critical incidents or crisis contingencies.

Nice To Haves

Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units such as 10th Fleet, 16th Air Force, or ARCYBER.
Experience conducting structured threat hunting (DCI/DD) across cloud and enterprise on-premises networks.
Knowledge of malware triage and dynamic/static analysis concepts, including sandboxing, de-obfuscation, hashing, and C2 extraction.
Familiarity with AI prompting tools such as Gemini, Grok, and ChatGPT for automation and OSINT data collection.
Direct experience with DoD incident response frameworks such as CJCSM 6510.01F and DoDI 8530.01, and reporting platforms such as Rally and DISS.

Responsibilities

Analyze boundary sensor feeds, Netflow, and IDS/IPS logs with intelligence agencies, peer CSSPs, and commercial intelligence providers to support Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
Use MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify Living off the Land tradecraft, and assess threats traversing enterprise and cloud access points.
Author, refine, and disseminate actionable cyber threat analysis products, Threat Warnings, and Tippers for tactical defenders and boundary engineers.
Evaluate bypasses and telemetry from automated blocking platforms to identify adversary evasion techniques and malicious patterns and develop analytic hypotheses.
Coordinate threat analysis and standardized incident reporting with DISA Joint Operations Center, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and NSA.
Develop threat hypotheses from all-source intelligence, reconstruct adversary attack paths, and conduct structured threat hunting across enterprise endpoints and cloud enclaves.
Track advanced persistent threats targeting enterprise cloud ecosystems and analyze environments secured by Joint Warfighter Cloud Capability, Thunderdome ZTNA, and Microsoft Defender suite (EndGuard).
Translate threat intelligence and adversary TTPs into detection use cases, rule logic, and requirements for enterprise SIEM ingestion.
Aggregate threat indicators, malware behaviors, and adversary profiles from commercial feeds and internal investigations; contribute to the quarterly Aggregated Cyber Awareness Report.
Assess IAVAs and IAVBs against active adversary exploitation trends and provide technical threat context and impact assessments to mission partner enclaves.
Provide cyber threat intelligence and behavioral profiling for the PACOM Mission Network and Joint Operational Edge – Coalition Environment.
Analyze identity, credential, and access management telemetry and the PMN Master User Record to identify anomalous behavior, insider threats, and lateral movement.
Conduct all-source cyber analysis in Ford Island SCIFs using intelligence across JWICS, YLAN, and special-access enclaves up to Top Secret/SCI.
Brief senior executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary capabilities, campaigns, and strategic risk.