Senior Cyber Threat Analyst
Job Description
Hello,
\n
We have the below opening with one of our Fortune 500 clients located in the Washington, DC area. This is a 1-2 years FTE Contract position.
\n
\n
Title: Senior Cyber Threat Analyst
\n
\n
Years of Exp.: 8+ years exp.
\n
\n
Work Location: Washington, DC/Local Remote
\n
\n
VISA: US Citizen or Green Card Permanent Resident
\n
\n
Skills: threat analyst, soar tools; sentinelone, sentinelone hyberautomation, splunk enterprise, splunk soar, super intelligence security, soc, windows, linux/unix, aws, azure, gcp, python, powershell, bash, nist sp-800-53, cis controls, mitre att&ck, cisa nice, iso 28001 and 27002, fisma, fedramp,
\n
\n
Preferred: N/A
\n
\n
Certifications: security+, gcia, gcih, cysa+, cissp, giac, secai+ or gmon
\n
\n
Clearance: candidates that have or had at least a Public Trust Clearance will get preference.
\n
\n
All candidates must meet the below requirement for the Public Trust Clearance.
\n
1. Has candidate lived in the US for at least (5) years?
\n
(All candidates must have lived in the US for at least five years, and you will need to verify this information on the Public Trust Security Forms if selected)
\n
2. Has candidate been out of the US in the last (5) years more than (6) months cumulative?
\n
(Candidates will need to verify this information on the Public Trust Security Forms if selected)
\n
\n
Job Description:
\n
\n
Cyber Threat Analyst
\n
DAE Detection Integration/Automation/Super Intelligence (SI) Contractor, Roles, Responsibilities & Qualifications
\n
The CISO Operation is seeking a contractor to support the Detection and Automation Engineering (DAE) program by designing, implementing, and maintaining automated/Super Intelligence security detection, integration capabilities across enterprise security monitoring technologies. The contractor will strengthen threat detection and response through detection engineering, security automation, systems integration, data analysis, super intelligent and continuous improvement of detection content and workflows. The role requires close collaboration with security operations, threat intelligence, and incident response stakeholders, along with strong documentation and operationalization practices.
\n
\n
Core Roles & Responsibilities
\n
• Detection Engineering & Automation/SI: Build automation/SI and integration workflows to improve detection and response.
\n
• Security platform integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.
\n
• Requirements-to-implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.
\n
• Testing & validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.
\n
• Security data analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.
\n
• Documentation & sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations.
\n
• Cross-functional coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
\n
• Emerging capability evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.
\n
\n
Essential Technical Knowledge Areas (plus important/beneficial)
\n
• SOAR Tools: SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, Splunk SOAR
\n
• Super Intelligence (SI) Security
\n
• SOC operations and processes
\n
• Threat intelligence lifecycle and analysis
\n
• Incident response methodologies
\n
• Network protocols and architecture
\n
• Operating systems (Windows/Linux/Unix)
\n
• Cloud platforms (AWS/Azure/GCP)
\n
• Security architecture and design
\n
• Programming/scripting (Python, PowerShell, Bash)
\n
• API integration and development
\n
• Detection engineering methodologies
\n
• Security automation and orchestration concepts
\n
\n
Frameworks, Standards & Compliance Expectations
\n
• NIST SP 800-53 Security Controls
\n
• CIS Controls
\n
• MITRE ATT&CK Framework
\n
\n
Important/beneficial
\n
• CISA NICE Framework
\n
• ISO 27001/27002
\n
• FISMA
\n
• FedRAMP
\n
• OMB Circulars and Federal Cybersecurity Directives
\n
• Privacy Act
\n
\n
Important / Beneficial
\n
• Malware analysis
\n
• Digital forensics procedures
\n
• Risk assessment methodologies
\n
• Machine learning and SI for security
\n
\n
Certification Requirements
\n
• CompTIA Security+ (or equivalent baseline)
\n
• One of: GCIA, GCIH, or CompTIA CySA+
\n
• Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell, similar)
\n
\n
Preferred
\n
• CISSP or GIAC Security Essentials (GSEC)
\n
• Comptia SecAI+
\n
• GMON (or similar continuous monitoring/detection-focused certification)
\n
\n
Education/Overall experience:
\n
o A minimum of eight (8) years' relevant experience.
\n
o A degree from an accredited College/University in the applicable field of services is required. If the individual's degree is not in the applicable field then four additional years of related experience is required.
\n