Cyber Threat Hunter (TS/SCI Clearance Required)

Trellix

2d•Onsite

About The Position

Trellix is hiring a Cyber Threat Hunter for a full-time, onsite role in a classified environment at Fort Shafter, Hawaii. The position involves developing and delivering detailed IT solutions through Professional Services consulting activities from project initiation through completion and final invoicing. The consultant will work on complex problems requiring in-depth evaluation, exercise judgment in selecting methods and criteria, and may provide work leadership by assigning tasks and resolving problems. The consultant will manage client engagements related to Trellix product and service offerings; produce reports of findings and analysis; contribute to internal expertise and process improvements; maintain technical proficiency; and support client development, knowledge sharing, mentoring, and training. The role also involves customer and internal stakeholder engagement, project cost and schedule monitoring, estimating, proposal development, invoicing, and potentially participating in sales presentations. The Cyber Threat Hunter will apply knowledge of threats, attack vectors, detection, countermeasures, incident management, threat hunting, endpoint protection, operating-system hardening, security operations, and network analysis. They will assess configurations and architectures, recommend mitigations, analyze network traffic and packets, and support incident response and malware removal. The position includes delivering security application and endpoint protection designs, implementations, training, and knowledge transfer to customers, and authoring reports, architecture designs, optimization guides, and security best-practice papers. The role requires an active adjudicated Secret clearance and qualification for TS/SCI clearance, with up to 25% travel.

Requirements

At least 5 years of Threat Hunting experience or similar Federal Government Enterprise capability.
Currently hold an adjudicated Secret clearance and qualify for a TS/SCI clearance.
Meet one of the stated experience/education combinations: BA/BS plus 4 years of recent specialized experience, AA/AS plus 6 years of recent specialized experience, or a major certification plus 8 years of recent specialized experience.
Hold an active DoD 8570 or DoD 8140-compliant cybersecurity certification.
Understand cyber threats, attack vectors, detection capabilities, and associated countermeasures.
Understand organizational incident-management processes related to threats and vulnerabilities.
Have knowledge and experience creating detailed threat-hunting plans, briefings, and reports.
Have experience with Windows, Mac, and Linux operating-system and application hardening, including knowledge of artifacts and behaviors.
Have demonstrated technical proficiency in cybersecurity operations, cybersecurity engineering, and systems engineering.
Have detailed understanding of TCP/IP protocol suites and the ability to dissect and explain network traffic and packets.
Have experience with event correlation and analysis, and experience with a SIEM tool and working with a SIEM Analyst.
Have experience with virtualization such as VMware or Nutanix, cloud services such as AWS or Azure, and enterprise networks.
Have knowledge of DoD IT RMF, USCYBERCOM, the Intelligence Community, and JFHQ-DoDIN.
Have advanced proficiency with Microsoft Office products, including Word, Excel, and PowerPoint.
Have proficiency with Microsoft SCCM and/or other automatic reporting tools.
Understand Department of Defense military and Federal Government agency standards, and have experience with Federal Government and DoD IT security requirements.
Be adaptable to changing circumstances and operational needs.
Work onsite at Fort Shafter, Hawaii, in a classified environment, and travel up to 25%.

Nice To Haves

Experience working in a Security Operations Center monitoring security alerts and responding to and remediating detected issues.
Experience with one or more scripting languages, such as Python, PowerShell, Go, C#, or similar command-line scripting.
Experience scripting API integrations with response and orchestration tools such as SIEM, SOAR, and/or XDR platforms.

Responsibilities

Manage and perform client work related to Trellix product and service offerings.
Create engagement-end reports describing findings and analysis.
Help develop and maintain Solution Services intellectual capital around the product line.
Identify and implement improvements to existing processes and procedures.
Maintain technical proficiency through self-training or formal training.
Help identify and develop new clients and expert-services engagements.
Share knowledge across the Solution Services team and mentor peers in techniques, tools, and job skills.
Deliver training when required and help update or create training course material.
Interact with company and client managers, and support cost and schedule monitoring, estimating, proposal generation, and invoicing.
Participate in sales and proposal presentations and ongoing team account activities as needed.
Create detailed threat-hunting plans, briefings, and reports.
Analyze configurations for vulnerabilities, recommend mitigations, use network tools to assess risks, and assist with malware removal during incidents.
Characterize and analyze network traffic to identify anomalous activity or potential threats using packet-level and protocol analysis tools.
Deliver onsite and remote security application and endpoint-protection designs, implementations, training, and knowledge transfer for customers.
Identify application and network security architecture gaps and recommend strategies to improve information security practices.
Author formal reports, architecture designs, optimization guides, and security best-practice white papers.
Participate in customer, sales, product-development, and support meetings to gather data, scope work, evaluate or suggest product features, and help resolve product issues.
Recognize and generate potential product and consulting-services sales leads when appropriate.
Configure debugging, event-generation, and logging functions in applications and operating systems, including Syslog or flat-file generation.
Apply knowledge of Trellix Endpoint Security, Application Control/Change Control, ENS, TIE, DXL, DLP, HX, and IVX.
Support security alert monitoring, response, and remediation, as applicable to the engagement.