Cyber Threat Analyst

Quantum Sky•Miami Springs, FL

1d•$95,000 - $120,000•Onsite

About The Position

Quantum Sky is seeking an experienced, analytical Cyber Threat Analyst to join its Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role operates under the Global Services Management – Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract. The mission is to defend DODIN/DISN, USPACOM, and critical mission partner enclaves against advanced persistent threats and nation-state cyber actors. The analyst synthesizes multi-source intelligence, telemetry, and forensic data into actionable threat intelligence; analyzes adversary tactics, techniques, and procedures (TTPs); formulates threat indicators; tracks campaigns; and informs threat-driven defense operations across perimeter boundaries, multi-cloud platforms, and classified networks, including NIPRNet and SIPRNet up to Top Secret/SCI. The position includes boundary threat analysis, warning intelligence, campaign tracking, operational reporting, proactive threat hunting, cloud and zero-trust threat analysis, detection-use-case development, vulnerability and exposure intelligence, and all-source cyber analysis for PACOM mission networks. The analyst coordinates with military, government, intelligence, and mission-partner organizations and briefs senior and military leadership. The position requires U.S. citizenship, an applicable DoD 8140.03/DCWF certification or degree, and an active Top Secret clearance with eligibility to obtain SCI access upon start. An active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval. Standard operational shifts are required, with occasional surge or after-hours support during critical incidents or crisis contingencies.

Requirements

For Level II (Intermediate): Bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or a related discipline and 2+ years of direct cyber threat intelligence, all-source cyber analysis, or CND experience; or an Associate degree and 4+ years of experience; or 6+ years of relevant professional or military cyber intelligence experience in lieu of a degree.
For Level III (Senior): Bachelor’s degree and 4+ years of relevant experience; or an Associate degree and 6+ years; or 8+ years of relevant experience or military service in lieu of a degree.
Before the start date, hold a valid certification or degree compliant with DoD 8140.03/DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent, at Intermediate proficiency level. Accepted certifications include CompTIA CySA+, GCTI, CEH, CFR, GCIA, GCIH, CND, CISSP, CASP+ CE, or GCFA.
Be willing to obtain and maintain system access credentials required by operational mission requirements.
Understand adversary TTPs, threat actor attribution, and mapping adversary activity to MITRE ATT&CK.
Have experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.
Be able to analyze packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct intrusions.
Have hands-on familiarity querying enterprise SIEM platforms, including Splunk SPL, Elastic/Kibana, and Microsoft Sentinel KQL.
Have working knowledge of threat intelligence platforms and tools such as MISP, ThreatConnect, Anomali, VirusTotal, and Shodan.
Be willing and able to work standard operational shifts and provide occasional surge or after-hours support during critical incidents or crisis contingencies.
Be a U.S. citizen.
Hold an active Top Secret security clearance with eligibility to obtain SCI access upon start; candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.

Nice To Haves

Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units such as 10th Fleet, 16th Air Force, or ARCYBER.
Experience conducting structured threat hunting (DCI/DD) across cloud and enterprise on-premises networks.
Knowledge of malware triage and dynamic/static analysis concepts, including sandboxing, de-obfuscation, hashing, and C2 extraction.
Familiarity with AI prompting tools such as Gemini, Grok, or ChatGPT for automation and OSINT data collection.
Direct experience with DoD incident response frameworks such as CJCSM 6510.01F and DoDI 8530.01 and reporting platforms such as Rally and DISS.

Responsibilities

Analyze boundary sensor feeds, Netflow, and IDS/IPS logs alongside intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver warning intelligence and attack sensing and warning activities compliant with DoDI 8530.01.
Use MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaigns, identify Living off the Land tradecraft, and assess threats traversing enterprise Internet Access Points and Boundary Cloud Access Points.
Author, refine, and disseminate actionable cyber threat analyses, Threat Warnings, and Tippers for tactical defenders and boundary engineers.
Evaluate bypasses and telemetry from automated blocking platforms to identify evasion techniques and malicious patterns and develop analytic hypotheses.
Coordinate with DJOC, USPACOM J6, DCDC, USCYBERCOM, and NSA to synchronize threat analyses and maintain standardized incident reporting in Rally.
Develop threat hypotheses from all-source intelligence, reconstruct multi-stage attack paths, and conduct structured threat hunting across enterprise endpoints and cloud enclaves to validate or rule out malicious presence.
Track threats against enterprise cloud environments, including AWS GovCloud, Azure Government, Google Cloud Platform, and Oracle Cloud Infrastructure, as secured under JWCC, Thunderdome ZTNA, and Microsoft Defender suite (EndGuard).
Translate threat intelligence and adversary TTPs into detection use cases, rule logic, and detection requirements for SIEM platforms including Splunk, Microsoft Sentinel, Elastic, and JCRS-D.
Aggregate threat indicators, malware behaviors, and adversary profiles from commercial feeds and internal investigations; contribute to the quarterly Aggregated Cyber Awareness Report on threat forecasts and vulnerability exposures.
Assess IAVAs and IAVBs against active adversary exploitation trends and provide technical threat context and impact assessments to mission partner enclaves.
Provide cyber threat intelligence and behavioral profiling for the PACOM Mission Network (PMN) and Joint Operational Edge – Coalition Environment (JOE-CE).
Analyze identity, credential, and access-management telemetry and the PMN Master User Record to identify anomalous behavior, insider threats, and lateral movement.
Conduct all-source cyber analysis in SCIFs at Ford Island, examining intelligence across JWICS, YLAN, and special-access enclaves up to Top Secret/SCI.
Brief senior executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary capabilities, campaigns, and strategic risk postures.
Obtain and maintain privileged system-access credentials as required by operational mission requirements.
Work standard operational shifts and provide occasional surge or after-hours support during critical incidents or crisis contingencies.