Cyber Threat Analyst - JB Pearl Harbor, HI

Military Spouse Corporate Career Network•Pearl Harbor, HI

7d•Onsite

About The Position

Quantum Sky is seeking an experienced Cyber Threat Analyst for its Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role operates under the Global Services Management – Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, defending the Department of Defense Information Network, U.S. Pacific Command, and mission partner enclaves against advanced persistent threats and nation-state cyber actors. The analyst synthesizes intelligence, network telemetry, and forensic data into actionable threat intelligence; analyzes adversary tactics, techniques, and procedures (TTPs); develops threat indicators; tracks campaigns; and informs threat defense across perimeter boundaries, multi-cloud platforms, and classified networks ranging from NIPRNet and SIPRNet to Top Secret/SCI. The work includes boundary threat analysis and warning, enterprise CSSP intelligence and proactive threat hunting, cloud and Zero Trust threat analysis, vulnerability and exposure intelligence, and location-specific intelligence for PACOM mission networks. The position includes conducting all-source analysis in SCIFs at Ford Island and briefing senior executive and military leadership. The role is onsite. Standard operational shifts are required, with occasional surge or after-hours support during critical incidents or crisis contingencies.

Requirements

For Level II (Intermediate): bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or a related discipline and at least 2 years of direct relevant experience; or an associate degree and at least 4 years; or at least 6 years of relevant professional or military cyber intelligence experience in lieu of a degree.
For Level III (Senior): bachelor’s degree and at least 4 years of relevant experience; or an associate degree and at least 6 years; or at least 8 years of relevant experience or military service in lieu of a degree.
Before the start date, hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 531, Cyber Defense Incident Responder or equivalent, at intermediate proficiency. Accepted certifications include CompTIA CySA+, GCTI, CEH, CFR, GCIA, GCIH, CND, CISSP, CASP+ CE, or GCFA.
Understand adversary TTPs, threat actor attribution, and mapping adversary activity to MITRE ATT&CK.
Have experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.
Be able to analyze packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct intrusions.
Have hands-on familiarity querying enterprise SIEM platforms, including Splunk SPL, Elastic/Kibana, or Microsoft Sentinel KQL.
Have working knowledge of threat intelligence platforms and tools such as MISP, ThreatConnect, Anomali, VirusTotal, and Shodan.
Be willing and able to obtain and maintain system access credentials as required by operational mission requirements.
Be willing and able to work standard operational shifts, with occasional surge or after-hours support during critical incidents or crisis contingencies.
Be a U.S. citizen.
Hold an active Top Secret clearance with eligibility to obtain SCI access upon start, with a Tier 5 / SSBI investigation within scope. Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.

Nice To Haves

Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units such as 10th Fleet, 16th Air Force, or ARCYBER.
Experience conducting structured threat hunting (DCI/DD) across cloud and enterprise on-premises networks.
Knowledge of malware triage and dynamic/static analysis concepts, such as sandboxing, de-obfuscation, hashing, and C2 extraction.
Familiarity with AI prompting tools such as Gemini, Grok, and ChatGPT for automation and OSINT data collection.
Direct experience with DoD incident response frameworks such as CJCSM 6510.01F and DoDI 8530.01 and reporting platforms such as Rally and DISS.

Responsibilities

Analyze boundary sensor feeds, Netflow, and IDS/IPS logs alongside intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
Use MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify Living off the Land tradecraft, and assess threats traversing enterprise and cloud boundary access points.
Author, refine, and disseminate actionable battlefield cyber threat analyses, Threat Warnings, and Tippers for tactical defenders and boundary engineers.
Evaluate bypasses and telemetry from automated blocking platforms to identify adversary evasion techniques and malicious patterns and develop analytic hypotheses.
Coordinate threat analysis and standardized incident reporting with the DISA Joint Operations Center, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and NSA.
Develop threat hypotheses from all-source intelligence, reconstruct multi-stage attack paths, and conduct structured threat hunting across enterprise endpoints and cloud enclaves.
Track threats to enterprise cloud ecosystems, including AWS GovCloud, Azure Government, Google Cloud Platform, and Oracle Cloud Infrastructure, and analyze environments secured with Joint Warfighter Cloud Capability, Thunderdome ZTNA, and Microsoft Defender.
Translate threat intelligence and adversary TTPs into detection use cases, rule logic, and requirements for enterprise SIEMs, including Splunk, Microsoft Sentinel, Elastic, and JCRS-D.
Aggregate threat indicators, malware behaviors, and adversary profiles from commercial feeds and internal investigations and contribute to quarterly Aggregated Cyber Awareness Reports.
Assess IAVAs and IAVBs against active exploitation trends and provide threat context and impact assessments to mission partner enclaves.
Provide threat intelligence and behavioral profiling tailored to the PACOM Mission Network and Joint Operational Edge – Coalition Environment.
Analyze identity, credential, and access-management telemetry and the PMN Master User Record to identify anomalous behavior, insider threats, and lateral movement.
Conduct all-source cyber analysis in Ford Island SCIFs using intelligence from JWICS, YLAN, and special-access enclaves up to Top Secret/SCI.
Brief senior executive and military leadership across USPACOM, DISA PAC, and operational mission partners on threat capabilities, campaigns, and strategic risk postures.
Obtain and maintain system access credentials as required by operational mission requirements.
Work standard operational shifts and provide occasional surge or after-hours support during critical incidents or crisis contingencies.