Threat Hunt Lead (CBP)

Agile Defense • Ashburn, VA

1d • Hybrid

About The Position

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. The gap between what a tool flags and what is actually happening in the environment is where a threat hunter works, and on a program supporting continuous federal law enforcement operations, that gap is not theoretical. You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads. One thing is worth knowing before you apply. Most hunts do not find anything, and that is not failure. A hunt that rules out a hypothesis honestly is doing its job. The people who do well here are comfortable being wrong most of the time in service of being right when it counts.

Requirements

• Active CBP Background Investigation (CBP BI) and EOD strongly preferred.
• U.S. Citizenship required
• Led or performed structured threat hunting, using a framework such as MITRE ATT&CK to form and test hypotheses, not only reviewed alerts as they arrived.
• Turned a hunt finding into a production detection and can describe the process.
• Worked in an environment defending against threats targeting government or law enforcement data, not only general commercial risk.
• Comfortable working from incomplete or ambiguous signals and can describe how you decide when a hypothesis is worth pursuing.
• Hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.
• Certifications such as GCFA, GNFA, or equivalent are useful, but they are not a substitute for having found something real.

Nice To Haves

• Active CBP Background Investigation (CBP BI) and EOD strongly preferred.
• Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.

Responsibilities

• Form and test hypotheses about activity the SOC's existing detections might be missing.
• Dig into the environment to confirm or rule out hypotheses.
• Turn confirmed findings into detections other analysts can rely on going forward.
• Work closely with the Security Operations Center Manager.
• Hand confirmed findings to the incident response and digital forensics leads.
• Explain why a hypothesis was ruled out, not just report that it was.
• Turn hunt findings into production detections.
• Translate threat intelligence into hunts that are specific enough to test.
• Communicate what has not been hunted for yet and why.

Benefits

• Health Insurance
• Life Insurance
• Paid Time Off
• Holiday Pay
• short-term and long-term Disability
• Retirement
• Learning and Development opportunities
• other optional benefit elections
• $10,000 signing bonus for candidates with an active CBP BI. Payable after 90 days; standard terms apply.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed