Senior ICS Threat Hunt Analyst / Active Top Secret

Peraton•Arlington, VA

5d•Onsite

About The Position

Peraton is hiring a Senior ICS Threat Hunt Analyst for its Federal Strategic Cyber programs. This is an on-site position in Arlington, Virginia, supporting federal cybersecurity missions involving operational technology and critical infrastructure. The analyst leads proactive threat hunting across OT/ICS environments, serves as an ICS security subject matter expert, and provides intelligence analysis and recommendations to senior government intelligence and operations officials. The role works alongside host, network, and cloud forensic analysts in incident response and threat hunting engagements and supports technology adoption and ICS security strategy as a customer-facing expert.

Requirements

Bachelor's degree and 8 years of experience, or an associate's degree and 10 years of experience, or a high school diploma and 12 or more years of experience in lieu of a degree.
Hands-on experience with ICS, OT, and/or SCADA systems and the principles required to ensure their security and safe operation.
Demonstrated experience leading or conducting threat hunts, network reconnaissance, or adversary emulation in IT or OT environments.
Proficiency with internet-facing asset discovery and reconnaissance platforms such as Shodan, Censys, or ZoomEye.
Strong understanding of ICS/SCADA protocols, including Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm, or PROFINET, and their security implications.
Advanced understanding of networking concepts including the TCP/IP stack, routing, switching, network segmentation, firewalls, and IDS/IPS, and their application in IT/OT convergence architectures.
Experience correlating open-source information with network- or host-based anomalies and using cyber threat intelligence resources and tools such as VirusTotal.
Hands-on experience with open-source cyber threat or related tools, such as VirusTotal, Maltego, Shodan, Censys, or Exploit-DB.
Experience researching and analyzing cyber threats across multiple industries or multiple timeframes, including critical infrastructure sectors.
Practical experience applying threat intelligence analysis models such as MITRE ATT&CK for ICS, the Diamond Model, and the Cyber Kill Chain in client reports.
Experience producing completed all-source (unclassified and classified) finished intelligence assessments that meet ICD 203 analytic tradecraft standards.
Proven ability to collaborate and establish threat intelligence partnerships to improve information sharing and defenses.
U.S. citizenship required.
Active Top Secret security clearance with SCI eligibility required.
Ability to obtain and maintain DHS EOD agency clearance before starting.

Nice To Haves

One or more of the following certifications: SANS GIAC Global Industrial Cyber Security Professional (GICSP), GIAC Response and Industrial Defense (GRID), GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Enterprise Defender (GCED), GIAC Network Forensic Analyst (GNFA), GIAC Certified Incident Handler (GCIH), GIAC Penetration Tester (GPEN), CompTIA CySA+, CompTIA Network+, CompTIA Security+, Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), ISA/IEC 62443 Cybersecurity Certificate Program (ICSCP), Dragos Platform Certified Analyst, or Certified SCADA Security Architect (CSSA).
Experience with network traffic analysis tools such as Wireshark, Zeek, or NetworkMiner.
Experience with network scanning and enumeration tools such as Nmap or Masscan.
Familiarity with ICS-specific threat intelligence platforms such as Dragos WorldView, Claroty, or Nozomi Networks.
Knowledge of NIST SP 800-82 and IEC 62443 standards.
Experience developing threat hunt playbooks and standard operating procedures.
Experience with SIEM platforms and log analysis in OT environments.
Familiarity with PLC programming languages such as Ladder Logic, Structured Text, or Function Block Diagram.
Sector-specific experience in Energy, Water/Wastewater, Transportation, or Manufacturing.
Deep understanding of PLC, HMI, RTU, and DCS architectures and their associated vulnerabilities.

Responsibilities

Lead proactive threat hunts across OT/ICS environments and develop hypotheses based on adversary tactics, techniques, and procedures, vulnerability disclosures, and intelligence reporting.
Serve as an ICS security subject matter expert for internet-facing asset exposure analysis, OT network architecture reviews, and threat landscape assessments.
Use reconnaissance and asset discovery platforms such as Shodan, Censys, and ZoomEye to map critical infrastructure attack surfaces and identify systemic risks.
Analyze ICS communication protocols to identify anomalies, misconfigurations, and indicators of adversary activity.
Fuse intelligence sources to develop products and recommendations and inform organizational priorities.
Research and investigate threats in operational technology, critical infrastructure sectors, and mission areas to inform senior leaders and operational teams, including incident response and threat hunting functions.
Analyze collected data to assess adversary capabilities, intentions, approaches, resource allocations, motivations, and tendencies, and contribute to profiles of adversarial behavior involving critical infrastructure attacks.
Prepare assessments and cyber threat profiles concerning current events and trends in ICS/SCADA environments.
Escalate new or high-priority threats to the Cyber Physical Forensics Section as required.
Map ICS threat activity using the MITRE ATT&CK for ICS Framework.
Collaborate with host, network, and cloud forensic analysts to support incident response and threat hunting engagements.
Develop and maintain analytical procedures, hunt playbooks, and tradecraft documentation as mission requirements evolve.
Identify potential open-source vulnerabilities in ICS/SCADA systems and assess exploitability against real-world threat actor capabilities.
Identify and analyze classified threat intelligence reporting related to ICS/SCADA, including adversary intent and capability.
Lead development of Pre-Deployment Readiness Packages and campaign tracking.
Produce papers, presentations, recommendations, and findings for senior U.S. government intelligence and operations officials.
Serve as a customer-facing subject matter expert supporting technology adoption and ICS security strategy.