Senior Threat Hunter

About the role

The C5ISR Center Cyber Security Service Provider (CSSP), a defensive cyber operations organization supporting the Department of War, is hiring a Senior Threat Hunter at Fort Huachuca, AZ. The role proactively identifies, investigates and mitigates sophisticated cyber threats across subscriber networks, applying deep knowledge of the threat landscape to build detection strategies and neutralize adversary activity targeting the Department of Defense Information Network (DoDIN). The position is hybrid (3 days on site at Fort Huachuca) and requires U.S. citizenship and an active TS/SCI clearance.

Key responsibilities

• Lead and support incident response during high-severity cyber incidents, recommending containment, remediation and recovery actions.
• Conduct proactive threat hunting across cloud and on-premises subscriber environments to find malicious or suspicious activity early.
• Identify adversary TTPs and develop countermeasures such as custom signatures, detection rules and correlation logic.
• Build, tune and monitor AI-assisted detections, including machine learning capabilities, to spot adversary behavior and movement.
• Integrate threat intelligence into sensing and detection infrastructure and use advanced cybersecurity tools to detect, analyze and mitigate threats.
• Develop and refine threat-hunting hypotheses based on intelligence, emerging threats and anomalous activity.
• Produce clear reports on findings, risk and remediation recommendations for technical teams, stakeholders and senior leadership.
• Collaborate with cybersecurity, IT and network teams, and deliver cybersecurity training to threat hunters and network defenders.
• Mentor team members and brief senior leaders on cyber threat activity and significant incidents.

Required profile

• Bachelor's degree and 8+ years of relevant cybersecurity experience, or 7+ years in cyber analysis, threat hunting and/or purple-team or blue-team operations.
• Experience with a U.S. Government Cyber Security Service Provider (CSSP).
• Demonstrated experience investigating sophisticated threats and improving threat detection.
• Working knowledge of adversary TTPs and their use in threat hunting, detection engineering and incident response.
• Experience in complex enterprise environments, including cloud, SaaS and on-premises infrastructure.
• Certification such as Security+ and a CSSP Analyst certification (e.g., CEH, GCIH or equivalent).
• Excellent written, verbal and interpersonal communication skills.