SITEC - Cyber Threat Hunter - MacDill AFB

Peraton • Tampa, FL

1d • $80,000 - $128,000 • Onsite

About The Position

The Cyber Threat Hunter serves as a specialized technical expert responsible for proactively identifying, tracking, and disrupting sophisticated cyber adversaries that have bypassed traditional perimeter defenses and automated security controls. Rather than relying solely on reactive alerts, the Threat Hunter formulates structured, hypothesis-driven hunt campaigns grounded in Cyber Threat Intelligence (CTI), adversary Tactics, Techniques, and Procedures (TTPs), and the MITRE ATT&CK framework. Operating across multi-terabyte telemetry environments, the hunter analyzes raw endpoint, network, and cloud artifacts to uncover stealthy lateral movement, persistence mechanisms, and advanced persistent threat (APT) activity. Findings from completed hunts are transitioned into production detection rules and response playbooks to continuously mature the enterprise security posture.

Requirements

• Min 12 years with HS degree, 10 years with AS/AA degree, 8 years with BS/BA, 6 years with MS/MA, 3 years with PhD
• DoD 8570 IAT II Certification
• DoW TS/SCI clearance
• Must be DoW 8140 compliant under the Work Role Code 531– Cyber Defense Incident Responder - Intermediate level or higher

Nice To Haves

• Strong analytical and problem-solving skills
• Ability to communicate security issues clearly to both technical and non-technical stakeholders
• Strong understanding of security technologies used to defend Enterprise networks such as EDR, XDR, IDS, IPS, SIEM and SOAR.
• Hands-on experience using SIEM solutions such as Splunk and Microsoft Sentinel to create threat detections.
• Experience with tracking adversarial TTPs and developing hunt.
• Overtime, shift differential, and a discretionary bonus may be available.

Responsibilities

• Develop, test, and execute proactive, intelligence-led threat hunt hypotheses across enterprise endpoints, networks, and cloud workloads to discover undetected intrusions and advanced persistent threats (APTs).
• Analyze tactical and operational Cyber Threat Intelligence (CTI) reports, actor profiles, and technical indicators to extract adversary TTPs, operationalizing them into focused, enterprise-wide search patterns.
• Systematically map hunting activities, discovered gaps, and adversary behavioral analytics against the MITRE ATT&CK framework to ensure comprehensive coverage across the cyber kill chain.
• Query, analyze, and correlate large-scale enterprise data sets using advanced search languages (e.g., Splunk SPL, KQL, SQL) across raw data sources including Endpoint Detection and Response (EDR), Sysmon, Windows Event Logs, network flow, and authentication logs.
• Partner closely with Detection Engineers and SOC analysts to translate confirmed hunt techniques and malicious patterns into durable, automated SIEM correlation rules and SOAR response workflows.
• Produce detailed hunt reports, executive summaries, and tactical findings dossiers detailing discovered activity, root cause analyses, coverage metrics, and defensive gap remediation recommendations.
• Execute end-to-end hunt operations by formulating specific behavioral queries, extracting and normalizing large-scale telemetry, and applying data stacking/frequency analysis to isolate statistical outliers, anomalous parent-child process relationships, and unauthorized binary executions from normal enterprise baselines.

Benefits

• Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace.
• The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces.
• Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: High school or GED