Threat Hunt Lead (CBP)

About Agile Defense

At Agile Defense we know that action defines the outcome and new challenges require new solutions. That’s why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next.

Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation’s vital interests.

Title: Threat Hunt Lead (CBP)

Clearance: Active Top Secret with SCI eligibility, ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD, active BI strongly preferred. We can begin processing for candidates who do not hold one.

Citizenship: U.S. Citizenship required

Location: Reston, VA - Hybrid

Salary Range: $165,000-200,000

Signing Bonus: $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply.

Required Certification(s): GIAC, GCIH or CEH

The Role

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. The gap between what a tool flags and what is actually happening in the environment is where a threat hunter works, and on a program supporting continuous federal law enforcement operations, that gap is not theoretical. You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads. One thing is worth knowing before you apply. Most hunts do not find anything, and that is not failure. A hunt that rules out a hypothesis honestly is doing its job. The people who do well here are comfortable being wrong most of the time in service of being right when it counts.

What Success Looks Like

Objective 1: Find what automated detection misses

Hunts are grounded in a real hypothesis about adversary behavior, not a general look around for anything unusual.

Confirmed findings represent activity that existing detections did not catch, which is the actual measure of whether hunting is adding value beyond the SOC's standing tools.

You can explain why you ruled a hypothesis out, not just report that you did.

Objective 2: Turn what you find into detection that outlives the hunt

Confirmed findings become new detection logic, so the next occurrence gets caught automatically instead of requiring another manual hunt.

Detection you build gets tuned as conditions change, rather than left as originally written.

Other analysts can use what you built without needing you to explain it every time.

Objective 3: Hand off findings clean enough to act on immediately

When a hunt confirms real activity, incident response gets a finding they can act on without redoing your investigative work.

Evidence and context are preserved well enough that digital forensics can pick up where you left off if a case needs that depth.

You know when a finding needs to escalate now versus when it can go through standard reporting.

Objective 4: Keep the hunting program grounded in what actually threatens this environment

Hunt hypotheses reflect the tactics that matter for a federal law enforcement environment, not a generic threat list.

Threat intelligence gets translated into hunts that are specific enough to test, not left as a general awareness exercise.

You can say what you have not hunted for yet and why, rather than presenting coverage as complete.

What You Bring

Minimum required experience

One of the folowing certificatations: GCIA, GCIH or GFCA OR CEH

A minimum of five (5) years of experience as a Tier 3 senior cyber threat hunt analyst performing threat analysis, technical analysis, and network asset traversal.

A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host and network-based security monitoring using cybersecurity capabilities.

Applicant will possess a strong cyber security background with experience in host and network-based forensics related to the identification of advanced cyber threat activities, intrusion detection, malware identification, and security content development (e.g., signatures, rules, queries etc.).

Shall have experience interpreting a variety of scripts or programming languages to support cyber threat hunts or malware analysis in a variety of formats, such as VB scripts, Python, PowerShell, JavaScript, and HTML, XML or other types needed for analysis.

Candidates will have experience in conducting cyber threat hunt analysis, utilizing cyber threat intelligence to identify and prioritize tactics, techniques, and procedures to hunt against.

Have a deep knowledge of capabilities and experience with security information and event management (SIEM) and networked-device management tools such as Splunk and EDR solutions.

Candidates will have experience in maintaining a comprehensive understanding of the cyber threat landscape, including identifying and analyzing cyber threats actors and activities to enhance cybersecurity posture of the organization’s IT operating environment.

Will work with the Cyber Threat Intelligence team to report significant findings of importance to leadership as well as coordinate with Pentest team and asset owners to deconflict findings.

Candidate will lead the Cyber Threat Hunt team to propose corrective actions and inform the necessary parties of security issues, reportable offenses, or cybersecurity best practices.

Candidate will have strong written and oral communication skills

Preferred Experience

Additional certifications such as: GFCA, GREM, GFNA,OSCP, GPEN

You have led or performed structured threat hunting, using a framework such as MITRE ATT&CK to form and test hypotheses, not only reviewed alerts as they arrived.

You have turned a hunt finding into a production detection and can describe the process.

You have worked in an environment defending against threats targeting government or law enforcement data, not only general commercial risk.

You are comfortable working from incomplete or ambiguous signals and can describe how you decide when a hypothesis is worth pursuing.

You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date.

Certifications such as GCFA, GNFA, or equivalent are useful, but they are not a substitute for having found something real.

A note on timing

We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply.

Employee Benefits

Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections.