{"id":2587829,"url":"https://alion.io/job/cfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated","title":"AOUSC - Threat Hunt Lead - cFocus Software Incorporated","company":{"id":4419850,"name":"cFocus Software Incorporated","domain":"cfocussoftware.com","url":"https://alion.io/company/cfocussoftware","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"JazzHR","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":119000,"max_usd":246000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":373},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Jira","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"ServiceNow","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-15T04:37:32Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-16T03:00:41Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"cFocus Software seeks a Threat Hunt Lead to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.\nQualifications:\nActive Public Trust clearance\nB.S. Computer Science, Information Technology, or a related field\n5+ years within IR in a large SOC (over 5,000 endpoints) with at least 3 years focused on proactive threat hunting or adversary emulation. \n3+ years of experience with demonstrated proficiency in forming hypothesis, querying large datasets and identifying APT behavior. \n2+ years’ experience with demonstrated proficiency in scripting languages including Python and PowerShell to develop new tools. \nThis role most closely aligns with the NICE work role PD-WRL-006 (Threat Analysis).\nActive OSCP or GXPN certification\nDuties:\nLead proactive threat hunting operations to identify Advanced Persistent Threats (APT), insider threats, malicious activity, and anomalous behaviors that evade traditional security controls.\nDevelop and execute hypothesis-driven threat hunts leveraging threat intelligence, adversary tactics, techniques, and procedures (TTPs), behavioral analytics, and anomalous telemetry.\nCoordinate threat hunt activities within Agile two-week sprint cycles and ensure successful execution of all assigned hunt objectives and deliverables.\nDevelop Threat Hunt Execution Plans that define hunt hypotheses, objectives, technical methodologies, required telemetry, and investigative procedures.\nAnalyze endpoint, network, cloud, identity, SIEM, EDR, and log telemetry to identify indicators of compromise (IOCs), suspicious activity, and attack patterns.\nCoordinate and escalate confirmed or suspected findings to the Cybersecurity Triage and Incident Response teams in accordance with the Judiciary SOC Incident Response Plan (JSOCIRP).\nCollaborate with Detection Engineering teams to identify and remediate logging, telemetry, detection, or visibility gaps discovered during threat hunting operations.\nWork closely with Cyber Threat Intelligence teams to operationalize intelligence, enrich investigations, and identify emerging threats impacting the Judiciary.\nConduct advanced analysis of threat actor behaviors, malware campaigns, phishing activity, suspicious infrastructure, and attack trends.\nDevelop detailed Threat Hunt Reports documenting hunt objectives, findings, TTPs, queries used, telemetry gaps, identified risks, and recommendations for improved detections.\nProduce executive-level Hunt Sprint Reports summarizing hunt activities, operational impacts, recommendations, and emerging cybersecurity risks.\nProvide real-time investigative support during cybersecurity incidents and high-priority threat investigations.\nPerform analysis utilizing Splunk Enterprise Security, Microsoft Sentinel, Splunk SOAR, CrowdStrike, Qualys, ServiceNow, Jira, and other AO-approved security platforms.\nSupport the development and refinement of threat models tailored to Judiciary systems, high-value assets, and mission-critical environments.\nDevelop and maintain threat hunting SOPs, playbooks, technical procedures, and investigative methodologies aligned with AO and federal cybersecurity standards.\nSupport enterprise security awareness initiatives through threat briefings, technical reporting, and operational presentations.\nParticipate in weekly technical meetings, operational reviews, and status briefings with AO leadership and federal stakeholders.\nProvide mentorship, technical guidance, and quality oversight to threat hunters and supporting analysts.\nSupport transition-in and transition-out activities, operational readiness, documentation development, and knowledge transfer activities.\nDrive continuous improvement initiatives focused on detection coverage, telemetry enrichment, operational efficiency, and threat hunting maturity.","description_format":"text","description_chars":3929,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence"],"lifecycle":[{"event":"open","at":"2026-10-15T04:37:32Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":35,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/cfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated","json_url":"https://alion.io/job/cfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated.json","meta":{"generated_at":"2026-10-16T06:14:15Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3748,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4419850},"rest":"https://alion.io/mcp/rest/get_company?id=4419850"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcfocussoftware-aousc-threat-hunt-lead-cfocus-software-incorporated"}]}