Senior ICS Threat Hunt Analyst / Active Top Secret

Lead proactive threat hunting operations across OT/ICS environments, developing hunt hypotheses based on adversary TTPs, vulnerability disclosures, and intelligence reporting.

• Serve as subject matter expert (SME) for ICS security activities, including internet-facing asset exposure analysis, OT network architecture review, and threat landscape assessments.
• Leverage advanced reconnaissance and asset discovery platforms (e.g., Shodan, Censys, ZoomEye) to map critical infrastructure attack surfaces and identify systemic risks.
• Conduct in-depth analysis of ICS communication protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm, PROFINET) to identify anomalies, misconfigurations, and indicators of adversary activity.
• Fuse multiple intelligence sources to develop products, recommendations, and inform priorities for the organization.
• Perform research and investigate current threats in operational technology, specific critical infrastructure sectors, and mission areas to inform senior leaders and drive priorities for operational teams, including forward-deployed incident response and threat hunting functions.
• Analyze collected data to derive facts and projections concerning adversary capabilities, intentions, and attack approaches-research resource allocations, motivations, tendencies, and contribute to profiling adversarial behavior with respect to critical infrastructure system attacks.
• Prepare assessments and cyber threat profiles of current events and trends within ICS/SCADA environments.
• Escalate new or high-priority threats to the Cyber Physical Forensics Section as required.
• Map ICS threat activity using the MITRE ATT&CK for ICS Framework.
• Seamlessly work alongside a team of host, network, and cloud forensic analysts to meet mission requirements for both incident response and threat hunting engagements.
• Develop and maintain analytical procedures, hunt playbooks, and tradecraft documentation to meet evolving mission requirements.
• Identify potential open-source vulnerabilities existing within ICS/SCADA systems and assess exploitability in the context of real-world threat actor capabilities.
• Identify classified threat intelligence reporting related to ICS/SCADA and analyze for adversary intent and capability.
• Lead development of Pre-Deployment Readiness Packages and campaign tracking.
• Produce high-quality papers, presentations, recommendations, and findings for senior U.S. government intelligence and operations officials.
• Serve as a customer-facing SME supporting technology adoption and ICS security strategy.

• Bachelor’s degree and 8 years of experience, or an Associate’s degree and 10 years, or HS and 12+ years of experience in lieu of a degree
• Hands-on experience with Industrial Control Systems (ICS), Operational Technology (OT), and/or Supervisory Control and Data Acquisition (SCADA) systems, and the underlying principles necessary to ensure security and safe function of ICS systems
• Demonstrated experience leading or conducting threat hunt operations, network reconnaissance, or adversary emulation in IT or OT environments
• Proficiency with internet-facing asset discovery and reconnaissance platforms (e.g., Shodan, Censys, ZoomEye) for identifying and assessing exposed critical infrastructure
• Strong understanding of ICS/SCADA protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm, PROFINET) and their security implications
• Advanced understanding of networking concepts (TCP/IP stack, routing, switching, network segmentation, firewalls, IDS/IPS) and their application in IT/OT convergence architectures
• Experience connecting open-source information with network and/or host-based anomalies (e.g., identifying cyber threat intelligence about suspicious processes, finding new insights through tools such as VirusTotal, understanding how to find threat intelligence about malformed network traffic, etc.)
• Hands-on experience with open-source cyber threat/related tools (e.g., VirusTotal, Maltego, Shodan, Censys, exploit-db, etc.)
• Experience researching and analyzing cyber threats across either a) multiple industries or b) multiple timeframes, including but not limited to critical infrastructure sectors
• Practical experience using common threat intelligence analysis models such as MITRE ATT&CK for ICS, the Diamond Model, and the Cyber Kill Chain to incorporate into client reports
• Experience producing and completing all-source (unclassified and classified) finished intelligence assessments that adhere to ICD203 analytic tradecraft standards
• Proven ability to collaborate and establish key threat intelligence partnerships to bolster information sharing and defenses
• U.S. citizenship required
• An Active Top Secret Security Clearance with SCI eligibility
• Additionally, have the ability to obtain/maintain DHS EOD agency clearance prior to starting

Preferred Qualifications:

Certifications (any of the following):

• SANS GIAC Global Industrial Cyber Security Professional (GICSP)
• SANS GIAC Response and Industrial Defense (GRID)
• SANS GIAC Cyber Threat Intelligence (GCTI)
• SANS GIAC Certified Enterprise Defender (GCED)
• SANS GIAC Network Forensic Analyst (GNFA)
• SANS GIAC Certified Incident Handler (GCIH)
• SANS GIAC Penetration Tester (GPEN)
• CompTIA CySA+
• CompTIA Network+
• CompTIA Security+
• Certified Ethical Hacker (CEH)
• Offensive Security Certified Professional (OSCP)
• ISA/IEC 62443 Cybersecurity Certificate Program (ICSCP)
• Dragos Platform Certified Analyst
• Certified SCADA Security Architect (CSSA)

Nice-to-Have Skills (not required):

• Experience with network traffic analysis tools (e.g., Wireshark, Zeek, NetworkMiner)
• Experience with network scanning and enumeration tools (e.g., Nmap, Masscan)
• Familiarity with ICS-specific threat intelligence platforms (e.g., Dragos WorldView, Claroty, Nozomi Networks)
• Knowledge of NIST SP 800-82 (Guide to ICS Security) and IEC 62443 standards
• Experience developing threat hunt playbooks and standard operating procedures
• Experience with SIEM platforms and log analysis in OT environments
• Familiarity with PLC programming languages (e.g., Ladder Logic, Structured Text, Function Block Diagram)
• Sector-specific experience in Energy, Water/Wastewater, Transportation, or Manufacturing
• Deep understanding of PLC, HMI, RTU, and DCS architectures and their associated vulnerabilities

Peraton is currently hiring Senior ICS Threat Hunt Analysts for its Federal Strategic Cyber programs., Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world’s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees do the can’t be done by solving the most daunting challenges facing our customers. Visit peraton.com to learn how we’re keeping people around the world safe and secure. Target Salary Range