{"id":2587830,"url":"https://alion.io/job/cfocussoftware-cyber-threat-hunter-cfocus-software-incorporated","title":"Cyber Threat Hunter - cFocus Software Incorporated","company":{"id":4419850,"name":"cFocus Software Incorporated","domain":"cfocussoftware.com","url":"https://alion.io/company/cfocussoftware","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"JazzHR","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":110000,"max_usd":214000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1245},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Agile","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"ITSM","optional":false},{"name":"Jira","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Nessus","optional":false},{"name":"Scrum","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Sysmon","optional":false},{"name":"Zscaler","optional":false}],"status":"live","first_seen_at":"2026-10-15T04:37:32Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-15T09:46:47Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"cFocus Software seeks a Mid Level Cyber Threat Hunter to join our program supporting US Courts in Washington, DC. This position is 4 days a week onsite in DC and one day remote.\nRequired Qualifications include:\n5+ years of experience performing threat hunts & incident response activities for cloud-based and non-cloud-based environments, such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Zscaler\n5+ years of experience performing hypothesis-based threat hunt & incident response utilizingSplunk Enterprise Security.\n5+ years of using Splunk to create queries and look up tables.\n 5+ years of experience collecting and analyzing data from compromised systems using EDR agents (e.g. CrowdStrike) and custom scripts (e.g. Sysmon & Auditd)\n5+ years of experience with the followingthreat hunting tools:Microsoft Sentinel for threat hunting within Microsoft Azure;\nTenable Nessus and SYN/ACK for vulnerability management;\nNetScout for analyzing network traffic flow;\nSPUR.us enrichment of addresses\n Mandiant Threat intel feeds\n\nMust be able to work 80% (Monday thru Thursday) onsite at AOUSC office in Washington, DC\n Desired Qualifications include:One of the following certifications:GIAC Certified Intrusion Analyst (GCIA)\nGIAC Certified Incident Handler (GCIH)\nGIAC Continuous Monitoring (GMON)\nGIAC Defending Advanced Threats (GDAT)\nSplunk Core Power User\n\n Duties:Provide incident response services after an incident is declared and provides a service that proactively searches for security incidents that would not normally be detected through automated alerting.\nThe Threat Hunt mission is to explore datasets across the judicial fabric to identify unique anomalies that may be indicative of threat actor activity based on the assumption that the adversary is already present in the judicial fabric.\nAccept and respond to government technical requests through the AOUSC ITSM ticket (e.g., HEAT or Service Now), for threat hunt support. Threat hunt targets include cloud-based and non-cloud-based applications such as: Microsoft Azure, Microsoft O365, Microsoft Active Directory, and Cloud Access Security Brokers (i.e., Zscaler).\nReview and analyze risk-based Security information and event management (SIEM) alerts when developing hunt hypotheses.\nReview open-source intelligence about threat actors when developing hunt hypotheses.\nPlan, conduct, and document iterative, hypothesis based, tactics, techniques, and procedures (TTP) hunts utilizing the agile scrum project management methodology.\nAt the conclusion of each hunt, propose, discuss, and document custom searches for automated detection of threat actor activity based on the hunt hypothesis.\nConfigure, deploy, and troubleshoot Endpoint Detection and Response agents (e.g., CrowdStrike and Sysmon).\nCollect and analyze data from compromised systems using EDR agents and custom scripts provided by the AOUSC.\nTrack and document cyber defense incidents from initial detection through final resolution.\nInterface with IT contacts at court or vendor to install or diagnose problems with EDR agents.\nParticipate in government led after action reviews of incidents.\nTriage malware events to identify the root cause of specific activity.\nAttend daily Agile Scrum standups and report progress on assigned Jira stories.\nDeliverables:Hunt Hypotheses: Hunt hypotheses describe how an actor might operate in the network while remaining undetected. The hypothesis describes what is expected to happen if the hypothesis is true and what is expected to happen if the hypothesis is false. The hypothesis contains all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section.\nHunt Reports: Hunt reports describe the original hypothesis and all iterations. At each stage, the report details how the hypothesis was tested and the results. The reports contain all data required, is free from errors in grammar, spelling, content, and submitted in the specified times that are stated in the deliverable section.\n Detection Logic: Document and test detection logic for automated detection of threat actor activity based on hunt hypothesis. Detection logic in the form of Splunk Enterprise Security (ES) searches that are run at proposed intervals. Proposal and discussion will happen in agile scrum stand up meetings. Document in Jira stories.\n Advanced SME IR Reports: Timely Advanced SME IR Support for Priority 1 Security Events. SME actively participating in IR activities within 4 hours of request (7x24x365).\nIncident Report: Document all incident details in an incident report. Report shall include executive summary, details of incident, security impact of incident, timeline of incident, and actions taken.\nProvide Weekly Reports to the AOUSC Program Manager that documents all activities, tasks, tickets and documents worked on.\nDocument repeatable Standard Operation Procedures (SOPs) and playbooks for security use cases.","description_format":"text","description_chars":4991,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-15T04:37:32Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":38,"reasons":["conf:1","win:early"],"computed_at":"2026-10-15T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/cfocussoftware-cyber-threat-hunter-cfocus-software-incorporated","json_url":"https://alion.io/job/cfocussoftware-cyber-threat-hunter-cfocus-software-incorporated.json","meta":{"generated_at":"2026-10-15T11:07:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17081,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4419850},"rest":"https://alion.io/mcp/rest/get_company?id=4419850"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcfocussoftware-cyber-threat-hunter-cfocus-software-incorporated"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcfocussoftware-cyber-threat-hunter-cfocus-software-incorporated"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcfocussoftware-cyber-threat-hunter-cfocus-software-incorporated"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cfocussoftware-cyber-threat-hunter-cfocus-software-incorporated\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcfocussoftware-cyber-threat-hunter-cfocus-software-incorporated"}]}