Senior ICS Threat Hunt Analyst / Active Top Secret

Peraton•Arlington, VA

6d•$104,000 - $166,000•Onsite

About The Position

Peraton is hiring Senior ICS Threat Hunt Analysts for its Federal Strategic Cyber programs. This on-site role in Arlington, Virginia, supports threat hunting and incident response missions focused on operational technology (OT), industrial control systems (ICS), and supervisory control and data acquisition (SCADA) environments. The analyst leads proactive hunts, researches threats to critical infrastructure, produces intelligence assessments and recommendations, and serves as a customer-facing ICS security subject matter expert supporting technology adoption and security strategy. The position works alongside host, network, and cloud forensic analysts and supports senior U.S. government intelligence and operations officials. It requires an active Top Secret security clearance with SCI eligibility, U.S. citizenship, and the ability to obtain or maintain DHS EOD agency clearance before starting. The target salary range is $104,000–$166,000; employees may also be eligible for overtime, shift differential, and a discretionary bonus, depending on the position.

Requirements

Bachelor's degree and 8 years of experience, or an Associate's degree and 10 years of experience, or a high school diploma and 12 or more years of experience in lieu of a degree.
Hands-on experience with ICS, OT, and/or SCADA systems and the principles needed to ensure their security and safe operation.
Demonstrated experience leading or conducting threat hunting operations, network reconnaissance, or adversary emulation in IT or OT environments.
Proficiency with internet-facing asset discovery and reconnaissance platforms such as Shodan, Censys, or ZoomEye for identifying and assessing exposed critical infrastructure.
Strong understanding of ICS/SCADA protocols and their security implications.
Advanced understanding of networking concepts, including the TCP/IP stack, routing, switching, network segmentation, firewalls, and IDS/IPS, and their application in IT/OT convergence architectures.
Experience connecting open-source information with network or host-based anomalies, including researching cyber threat intelligence about suspicious processes, using tools such as VirusTotal to derive insights, and finding intelligence about malformed network traffic.
Hands-on experience with open-source cyber threat or related tools such as VirusTotal, Maltego, Shodan, Censys, and exploit-db.
Experience researching and analyzing cyber threats across multiple industries or multiple timeframes, including critical infrastructure sectors.
Practical experience applying threat intelligence analysis models such as MITRE ATT&CK for ICS, the Diamond Model, and the Cyber Kill Chain in client reports.
Experience producing and completing all-source unclassified and classified finished intelligence assessments in accordance with ICD203 analytic tradecraft standards.
Ability to collaborate and establish threat intelligence partnerships to strengthen information sharing and defenses.
U.S. citizenship required.
Active Top Secret security clearance with SCI eligibility required.
Ability to obtain or maintain DHS EOD agency clearance before starting.

Nice To Haves

Certification in one or more of the following: SANS GIAC Global Industrial Cyber Security Professional (GICSP), GIAC Response and Industrial Defense (GRID), GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Enterprise Defender (GCED), GIAC Network Forensic Analyst (GNFA), GIAC Certified Incident Handler (GCIH), GIAC Penetration Tester (GPEN), CompTIA CySA+, CompTIA Network+, CompTIA Security+, Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), ISA/IEC 62443 Cybersecurity Certificate Program (ICSCP), Dragos Platform Certified Analyst, or Certified SCADA Security Architect (CSSA).
Experience with network traffic analysis tools such as Wireshark, Zeek, or NetworkMiner.
Experience with network scanning and enumeration tools such as Nmap or Masscan.
Familiarity with ICS-specific threat intelligence platforms such as Dragos WorldView, Claroty, or Nozomi Networks.
Knowledge of NIST SP 800-82 and IEC 62443 standards.
Experience developing threat hunt playbooks and standard operating procedures.
Experience with SIEM platforms and log analysis in OT environments.
Familiarity with PLC programming languages such as Ladder Logic, Structured Text, or Function Block Diagram.
Sector-specific experience in Energy, Water/Wastewater, Transportation, or Manufacturing.
Deep understanding of PLC, HMI, RTU, and DCS architectures and associated vulnerabilities.

Responsibilities

Lead proactive threat hunting operations across OT/ICS environments and develop hunt hypotheses based on adversary tactics, techniques, and procedures (TTPs), vulnerability disclosures, and intelligence reporting.
Serve as an ICS security subject matter expert for internet-facing asset exposure analysis, OT network architecture reviews, and threat landscape assessments.
Use reconnaissance and asset discovery platforms such as Shodan, Censys, and ZoomEye to map critical infrastructure attack surfaces and identify systemic risks.
Analyze ICS communication protocols to identify anomalies, misconfigurations, and indicators of adversary activity.
Fuse intelligence sources to develop products and recommendations and inform organizational priorities.
Research and investigate current OT threats, critical infrastructure sectors, and mission areas to inform senior leaders and operational teams, including forward-deployed incident response and threat hunting functions.
Analyze collected data to assess adversary capabilities, intentions, and attack approaches, including resource allocations, motivations, and tendencies, and contribute to adversary behavior profiles related to critical infrastructure attacks.
Prepare assessments and cyber threat profiles concerning current events and trends in ICS/SCADA environments.
Escalate new or high-priority threats to the Cyber Physical Forensics Section as required.
Map ICS threat activity using the MITRE ATT&CK for ICS Framework.
Collaborate with host, network, and cloud forensic analysts to meet incident response and threat hunting mission requirements.
Develop and maintain analytical procedures, hunt playbooks, and tradecraft documentation for evolving mission requirements.
Identify open-source vulnerabilities in ICS/SCADA systems and assess exploitability in light of real-world threat actor capabilities.
Identify and analyze classified threat intelligence reporting related to ICS/SCADA, including adversary intent and capability.
Lead development of Pre-Deployment Readiness Packages and campaign tracking.
Produce papers, presentations, recommendations, and findings for senior U.S. government intelligence and operations officials.
Serve as a customer-facing subject matter expert supporting technology adoption and ICS security strategy.