Cyber Threat Hunter/Incident Responder

Command Post Technologies, Inc.•Arlington, VA

22h

About The Position

Command Post Technologies, Inc. (CPT) is seeking experienced Cyber Threat Hunters and Incident Responders for anticipated opportunities supporting DARPA in Arlington, Virginia. The selected candidate will perform proactive cyber threat detection, advanced security incident analysis, malware investigation, and incident response across enterprise information systems. The role calls for hands-on cybersecurity experience, strong analytical skills, and the ability to find malicious activity that may evade traditional security monitoring. Candidates will investigate sophisticated cyber threats, analyze security telemetry, and develop actionable recommendations to strengthen defensive capabilities. Work location, onsite requirements, operational schedules, incident-response coverage, and travel will be determined by individual task orders. This requisition supports anticipated task-order opportunities under an awarded contract vehicle; employment is contingent on task-order award, funding, and position availability. CPT is a Service-Disabled, Veteran-Owned Small Business providing engineering services in cybersecurity, software development, test and evaluation, and strategic planning. The company describes its workplace as caring, with a focus on work-life balance, integrity, determination, innovation, communication, accountability, and resourcefulness.

Requirements

Final DoD Secret security clearance and ability to meet additional task-order security requirements.
At least 5 years of relevant experience in cybersecurity operations, threat hunting, incident response, digital forensics, or related disciplines.
Demonstrated experience investigating cybersecurity incidents and analyzing network or endpoint security data.
Strong understanding of common adversary TTPs, attack methods, and cybersecurity defensive techniques.
Experience with SIEM platforms, endpoint detection and response tools, network monitoring technologies, or digital forensic tools.
Working knowledge of TCP/IP, DNS, HTTP/S, Windows and Linux operating systems, and enterprise security architectures.
Ability to analyze technical evidence, document findings, and communicate incident information effectively.
Experience developing or following incident response procedures and coordinating technical investigations.

Nice To Haves

Experience supporting DoD hunt teams, CSSP operations, or advanced cybersecurity incident response.
GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Reverse Engineering Malware (GREM), GCFA, CySA+, or comparable cybersecurity certification.
Experience with Splunk, Elastic, Microsoft Sentinel, Microsoft Defender for Endpoint, Wireshark, Zeek, or similar tools.
Familiarity with MITRE ATT&CK, threat intelligence analysis, and detection engineering.
Experience conducting malware analysis, memory forensics, disk forensics, or email threat analysis.
Experience using Python, PowerShell, or other scripting languages to support analysis or automate investigations.
Experience conducting authorized penetration testing or security assessments.
Experience supporting classified networks or Special Access Program environments.
Prior experience supporting DARPA or another DoD research and development organization.

Responsibilities

Conduct proactive threat hunts to identify malicious activity, indicators of compromise, and suspicious behavior across enterprise environments.
Investigate cybersecurity incidents using network traffic, endpoint telemetry, security event logs, and threat intelligence.
Analyze incidents to determine attack vectors, scope, impact, and recommended mitigation actions.
Analyze suspicious files, email activity, malware indicators, and other artifacts to identify potential threats.
Profile threats and analyze adversary tactics, techniques, and procedures (TTPs).
Support incident response, including triage, investigation, containment, eradication, recovery, and post-incident analysis.
Develop and refine threat-detection methods, hunting procedures, and indicators to improve cybersecurity monitoring.
Analyze network flows, DNS activity, security alerts, and other sources to identify patterns associated with malicious activity.
Coordinate threat intelligence and incident findings with cybersecurity operations personnel and authorized Government stakeholders.
Support authorized security assessments and penetration testing when required.
Prepare incident reports, threat assessments, technical findings, and recommendations to improve defensive capabilities.
Collaborate with CND analysts, SIEM engineers, and other technical personnel to improve threat detection and incident response processes.