Threat Hunter

Strategic Operational Solutions • Fort Liberty, NC

2d • Onsite

About The Position

Strategic Operational Solutions (STOPSO) is seeking a Threat Hunter to support the U.S. Army Reserve Command (USARC) Defensive Cyberspace Operations Mission Support Services (DCOMSS) program at Fort Bragg, North Carolina. Find adversary activity through hypothesis-driven hunts that combine defensive telemetry and cyber threat intelligence. The Threat Hunter develops findings and detection improvements for Blue Team and CTI operations.

Requirements

• Minimum 3 years of documented relevant experience. Relevant threat hunting, intrusion analysis, detection development, SIEM/network analysis, and CTI integration experience.
• DoD Cyber Workforce Framework (DCWF) 511, Cyber Defense Analyst, Advanced proficiency, and DCWF 171, Cyber Threat Intelligence Analyst, Intermediate proficiency.
• Meet DoDM 8140.03 qualification requirements for every assigned work role and proficiency through an approved education, training, certification, or authorized experience route before independent cyber work. Document work-role appointment and qualification; maintain required residential qualification and continuing learning. A higher-level approved option may qualify the same role at a lower level.
• Current matrix-listed certification options for 511 Advanced: CBROPS, CFR, CySA+, GCFA, GCIA, GICSP. The additional 171 Intermediate intelligence qualification must be verified under the Government-approved criteria.
• Demonstrated knowledge of Threat hunting, intrusion analysis, MITRE ATT&CK, adversary TTPs, cyber threat intelligence, and detection engineering.
• Proficiency with SIEM, EDR, NetFlow, packet capture, YARA, Snort or Suricata, and host telemetry appropriate to assigned duties and approved access.
• Ability to produce accurate records, explain findings and decisions, and follow approved procedures and security requirements.
• Strong written and verbal communication skills and sound judgment when coordinating with technical staff and Government stakeholders.
• Strong organizational skills, confidentiality, and ability to work independently and collaboratively in a mission-focused environment.
• Active TS/SCI clearance and ability to maintain required SCI indoctrination and assigned system access.
• U.S. citizenship is required.

Nice To Haves

• Experience hunting across classified DoD cyber defense environments.
• Relevant DoD or enterprise IT experience with mission tooling and operational reporting.

Responsibilities

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and observed telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escalate actionable activity for incident response.
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, methods, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed