Threat Hunt Lead (CBP)

Agile Defense•Ashburn, VA

3d•Hybrid

About The Position

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. The gap between what a tool flags and what is actually happening in the environment is where a threat hunter works, and on a program supporting continuous federal law enforcement operations, that gap is not theoretical. You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads. One thing is worth knowing before you apply. Most hunts do not find anything, and that is not failure. A hunt that rules out a hypothesis honestly is doing its job. The people who do well here are comfortable being wrong most of the time in service of being right when it counts.

Requirements

Active CBP Background Investigation (CBP BI) and EOD strongly preferred.
U.S. Citizenship required.
Led or performed structured threat hunting, using a framework such as MITRE ATT&CK to form and test hypotheses.
Turned a hunt finding into a production detection and can describe the process.
Worked in an environment defending against threats targeting government or law enforcement data.
Comfortable working from incomplete or ambiguous signals and can describe how you decide when a hypothesis is worth pursuing.
Hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance.
Certifications such as GCFA, GNFA, or equivalent are useful.

Nice To Haves

We can begin processing for candidates who do not hold an active CBP BI.
We can begin processing a CBP BI for you if you do not hold one.

Responsibilities

Lead threat hunting for the program.
Form and test hypotheses about activity the SOC's existing detections might be missing.
Dig into the environment to confirm or rule out hypotheses.
Turn confirmed findings into detections that other analysts can rely on.
Work closely with the Security Operations Center Manager.
Hand confirmed findings to the incident response and digital forensics leads.
Explain why a hypothesis was ruled out.
Turn hunt findings into production detections.
Build and tune detection logic as conditions change.
Ensure other analysts can use built detections without needing constant explanation.
Provide findings to incident response that can be acted on immediately.
Preserve evidence and context for digital forensics.
Determine when a finding needs immediate escalation versus standard reporting.
Ensure hunt hypotheses reflect tactics relevant to a federal law enforcement environment.
Translate threat intelligence into specific, testable hunts.
Communicate what has not been hunted for and why.