Cyber Threat Analyst - JB Pearl Harbor, HI

VetJobs•Pearl City, HI

9d•$95,000 - $120,000•Onsite

About The Position

Quantum Sky is seeking an experienced, analytical Cyber Threat Analyst to join its Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role supports the Global Services Management – Operations II (GSM-O II) Task Order 22 Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, defending the Department of Defense Information Network, U.S. Pacific Command, and critical mission partner enclaves against advanced persistent threats and nation-state cyber actors. The analyst synthesizes multi-source intelligence, telemetry, and forensic data into actionable threat intelligence. The position analyzes adversary tactics, techniques, and procedures; develops threat indicators; tracks adversary campaigns; and informs threat-focused defense operations across perimeter boundaries, multi-cloud platforms, and classified networks, including NIPRNet and SIPRNet up to Top Secret/SCI. The role includes boundary threat analysis and warning intelligence, enterprise CSSP intelligence and proactive threat hunting, and PACOM- and TS/SCI-specific analysis. The analyst works with operational and intelligence partners, produces threat reporting and briefs, develops detection use cases, assesses vulnerabilities and adversary activity, and conducts all-source cyber analysis in SCIF environments. The position is onsite. Standard operational shifts are expected, with occasional surge or after-hours support during critical incidents or crisis contingencies.

Requirements

For Level II (Intermediate): a bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or a related discipline and 2 or more years of direct cyber threat intelligence, all-source cyber analysis, or CND experience; alternatively, an associate degree and 4 or more years of experience, or 6 or more years of relevant professional or military cyber intelligence experience in lieu of a degree.
For Level III (Senior): a bachelor’s degree and 4 or more years of relevant experience; alternatively, an associate degree and 6 or more years of experience, or 8 or more years of relevant experience or military service in lieu of a degree.
Before the start date, hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 531: Cyber Defense Incident Responder, or equivalent, at the Intermediate proficiency level. Accepted certifications include CompTIA CySA+, GCTI, CEH, CFR, GCIA, GCIH, CND, CISSP, CASP+ CE, or GCFA.
Be willing to obtain and maintain privileged system access credentials as required by operational mission requirements.
Understand adversary TTPs, threat actor attribution, and mapping adversary activity to MITRE ATT&CK.
Have experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.
Be able to analyze packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct adversary intrusions.
Have hands-on familiarity querying enterprise SIEM platforms, including Splunk SPL, Elastic/Kibana, and Microsoft Sentinel KQL.
Have working knowledge of threat intelligence platforms and tools such as MISP, ThreatConnect, Anomali, VirusTotal, and Shodan.
Be willing and able to work standard operational shifts and provide occasional surge or after-hours support during critical incidents or crisis contingencies.
Be a U.S. citizen.
Hold an active Top Secret security clearance with eligibility to obtain SCI access upon starting, with a Tier 5 / SSBI investigation within scope. Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.

Nice To Haves

Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units such as 10th Fleet, 16th Air Force, or ARCYBER.
Experience conducting structured threat hunting (DCI/DD) across cloud and enterprise on-premises networks.
Knowledge of malware triage and dynamic/static analysis concepts, such as sandboxing, de-obfuscation, hashing, and C2 extraction.
Familiarity with AI prompting tools such as Gemini, Grok, and ChatGPT for automation and OSINT data collection.
Direct experience with DoD incident response frameworks, including CJCSM 6510.01F and DoDI 8530.01, and reporting platforms such as Rally and DISS.

Responsibilities

Analyze boundary sensor feeds, Netflow, and IDS/IPS logs with intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
Use MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify Living off the Land tradecraft, and assess threats crossing enterprise Internet Access Points and Boundary Cloud Access Points.
Author, refine, and disseminate actionable battlefield cyber threat analysis products, Threat Warnings, and Tippers for tactical defenders and boundary engineers.
Evaluate automated blocking platform bypasses and telemetry to identify adversary evasion techniques and malicious patterns and develop analytic hypotheses.
Coordinate threat analysis and standardized incident reporting with the DISA Joint Operations Center, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and NSA.
Develop threat hypotheses from all-source intelligence, reconstruct multi-stage attack paths, and conduct structured threat hunting across enterprise endpoints and cloud enclaves to validate or rule out malicious presence.
Track advanced persistent threats across enterprise cloud ecosystems, including AWS GovCloud, Azure Government, Google Cloud Platform, and Oracle Cloud Infrastructure, as well as the Joint Warfighter Cloud Capability, Thunderdome ZTNA, and Microsoft Defender suite.
Translate threat intelligence and adversary TTPs into detection use cases, rule logic, and detection requirements for enterprise SIEM platforms.
Aggregate threat indicators, malware behaviors, and adversary profiles from commercial feeds and internal investigations, and contribute to the quarterly Aggregated Cyber Awareness Report.
Assess IAVAs and IAVBs against active adversary exploitation trends and provide threat context and impact assessments to mission partner enclaves.
Provide cyber threat intelligence and behavioral profiling for the PACOM Mission Network and Joint Operational Edge – Coalition Environment.
Analyze Identity, Credential, and Access Management telemetry and the PMN Master User Record to identify anomalous behavior, insider threats, and lateral movement.
Conduct all-source cyber analysis in Ford Island SCIFs using intelligence across JWICS, YLAN, and special-access enclaves up to Top Secret/SCI.
Brief senior executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary capabilities, active campaigns, and strategic risk.