Threat Hunter

Omniscius Consulting • Fort Bragg, NC

3d • Onsite

About The Position

The Threat Hunter supports the U.S. Army Reserve Command (USARC) Defensive Cyberspace Operations Mission Support Services (DCOMSS) program at Fort Bragg, North Carolina. The role finds adversary activity through hypothesis-driven hunts that combine defensive telemetry and cyber threat intelligence, and develops findings and detection improvements for Blue Team and CTI operations.

The position requires hunting across security and network data, analyzing potential intrusion activity, validating detections, documenting hunt work, and coordinating indicators and lessons learned with relevant teams. Work is primarily on site in a secure Government facility. Occasional local, CONUS, or OCONUS travel may be required for authorized mission activities.

Requirements

• Minimum 3 years of documented relevant experience, including relevant threat hunting, intrusion analysis, detection development, SIEM/network analysis, and CTI integration experience.
• DoD Cyber Workforce Framework (DCWF) 511, Cyber Defense Analyst, Advanced proficiency, and DCWF 171, Cyber Threat Intelligence Analyst, Intermediate proficiency.
• Meet DoDM 8140.03 qualification requirements for every assigned work role and proficiency through an approved education, training, certification, or authorized experience route before independent cyber work.
• Document work-role appointment and qualification; maintain required residential qualification and continuing learning. A higher-level approved option may qualify the same role at a lower level.
• For DCWF 511 Advanced, current matrix-listed certification options are CBROPS, CFR, CySA+, GCFA, GCIA, and GICSP. The additional DCWF 171 Intermediate intelligence qualification must be verified under Government-approved criteria.
• Demonstrated knowledge of threat hunting, intrusion analysis, MITRE ATT&CK, adversary TTPs, cyber threat intelligence, and detection engineering.
• Proficiency with SIEM, EDR, NetFlow, packet capture, YARA, Snort or Suricata, and host telemetry appropriate to assigned duties and approved access.
• Ability to produce accurate records, explain findings and decisions, and follow approved procedures and security requirements.
• Strong written and verbal communication skills and sound judgment when coordinating with technical staff and Government stakeholders.
• Strong organizational skills, confidentiality, and ability to work independently and collaboratively in a mission-focused environment.
• Active TS/SCI clearance and ability to maintain required SCI indoctrination and assigned system access.
• U.S. citizenship is required.

Nice To Haves

• Experience hunting across classified DoD cyber defense environments.
• Relevant DoD or enterprise IT experience with mission tooling and operational reporting.

Responsibilities

• Develop hunt hypotheses from adversary tactics, intelligence, indicators, and observed telemetry gaps.
• Search SIEM, EDR, NetFlow, packet, host, authentication, and CTI data for complex intrusion activity.
• Analyze findings, distinguish benign behavior from threats, and escalate actionable activity for incident response.
• Develop and validate correlation rules, signatures, and host-based detections with authorized sensor stakeholders.
• Document hunt objectives, methods, data sources, evidence, coverage gaps, and recommended actions.
• Coordinate indicator packages and lessons learned with CTI, Blue Team, and exercise personnel.
• Perform other duties as assigned consistent with the position's responsibilities, qualifications, clearance, and authorized scope.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed