> Markdown version of [/jobs/ext/4135079-resident-threat-operations-analyst](https://www.wearedevelopers.com/jobs/ext/4135079-resident-threat-operations-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Resident Threat Operations Analyst

- **Company:** Freehold Cartage Inc.
- **Location:** United States
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Cyber Security, Hypertext Transfer Protocols (HTTP), Python (Programming Language), Pcap, Log Analysis, Simple Mail Transfer Protocols, Network Forensics, Packet Analyzer, Open Source Intelligence, Performance Tuning, Windows PowerShell, Regular Expressions, Security Information and Event Management, Wireshark, Snort (Software), Transport Layer Security, Mitre Att&ck, Cyber Warfare, Splunk
- **Published:** October 7, 2026
- **Apply:** https://www.thejobnetwork.com/job/d2c30db1-d398-4f88-af1e-d15facf07323/cyber-security-analyst

## About the Role

* Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.
\n

 * Local to the Washington, DC metro area, with the ability to work on-site at the customer location.
\n

 * Prior experience as a Security Operations Center (SOC) analyst, threat hunter, incident responder, or in a similar cyber operations role, with a strong understanding of adversary tradecraft, analyst workflows, event triage, investigations, and incident response.
\n

 * Prior hands-on experience developing, tuning, validating, or operationalizing network detection technology in production environments, with depth sufficient to scope, evaluate, and guide detection engineering performed by others.
\n

 * Experience supporting cybersecurity operations within classified government environments.
\n

 * Demonstrated ability to rapidly learn complex cybersecurity technologies and become the trusted technical authority for those capabilities.
\n, * Network traffic analysis, including expert-level packet analysis (PCAP) and deep, layer-by-layer understanding of protocols such as TCP/IP, DNS, TLS, HTTP/HTTPS, SMB, SMTP, and QUIC, including how adversaries abuse them.
\n

 * Experience with detection technologies such as YARA, Suricata, Snort, Sigma, Wireshark, or comparable frameworks.
\n

 * Scripting and automation skills in Python, PowerShell, JavaScript, or similar, including developing and testing complex regular expressions (PCRE).
\n

 * Experience with malware triage, payload decoding, deobfuscation, and behavioral analysis.
\n

 * Familiarity with the MITRE ATT&CK framework as applied to detection development.
\n

 * Experience with enterprise SIEM platforms (Splunk preferred) and log analysis.
\n

 * Experience conducting operationally secure open-source intelligence (OSINT) research is a plus.
\n

 * Excellent written and verbal communication skills, with the ability to explain complex technical concepts to analysts, engineers, and government leadership.