> Markdown version of [/jobs/ext/1296152-cyber-threat-intelligence-threat-hunting-lead](https://www.wearedevelopers.com/jobs/ext/1296152-cyber-threat-intelligence-threat-hunting-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Intelligence & Threat Hunting Lead

- **Company:** cFocus Software Incorporated
- **Location:** Washington, DC, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Computer Telephony Integration, Intelligence Analysis, Intrusion Detection and Prevention, Security Information and Event Management, Mitre Att&ck, Malware, Cybercrime, Cyber Warfare, Splunk
- **Published:** July 16, 2026
- **Apply:** http://cfocussoftware.applytojob.com/apply/jobs/details/ggxsjXBx3Y

## About the Role

* 10+ years of cybersecurity operations experience.
 * 5+ years supporting CTI, threat hunting, or detection engineering programs.
 * Experience with:
 + Splunk,
 + Sentinel,
 + CrowdStrike,
 + EDR telemetry,
 + detection content engineering,
 + and intelligence platforms.
 * Strong understanding of:
 + MITRE ATT&CK,
 + adversary tradecraft,
 + malware analysis,
 + and intelligence analysis methodologies.
 * Experience developing:
 + SIEM detections,
 + hunt analytics,
 + detection tuning,
 + and operational reporting.

Preferred Certifications

 * GCTI
 * GCFA
 * GCIH
 * GMON
 * GCDA
 * CISSP
 * Splunk Security certifications

## Description

The Cyber Threat Intelligence & Threat Hunting Lead will oversee integrated cyber threat intelligence (CTI), detection engineering, and proactive threat hunting operations supporting enterprise cyber defense missions.
The Lead will drive development of intelligence-driven detections, hunt methodologies, adversary tracking, SIEM content engineering, and operational threat-informed defense capabilities., * Lead CTI, detection engineering, and threat hunting operations.

 * Develop intelligence-driven detection and hunt strategies.
 * Produce operational and strategic threat intelligence reporting.
 * Develop and maintain:
 + SIEM detections,
 + analytics,
 + correlation rules,
 + behavioral detections,
 + and hunt playbooks.
 * Conduct hypothesis-based threat hunting aligned to:
 + MITRE ATT&CK,
 + adversary TTPs,
 + malware campaigns,
 + and emerging threats.
 * Integrate CTI into SOC workflows, detection engineering, and incident response operations.
 * Analyze:
 + malware trends,
 + adversary infrastructure,
 + campaigns,
 + indicators,
 + and attack patterns.
 * Support automation and SOAR integration initiatives.
 * Brief executives and technical leadership on emerging threats and operational risk.


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Capture the Flag 101](https://www.wearedevelopers.com/videos/416-capture-the-flag-101)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)