Threat Hunt Lead (CBP) (Cybersecurity)

Location: Ashburn, Virginia, United States; hybrid workplace

Active CBP BI and EOD or another qualifying clearance can shorten the start date. Candidates without an existing clearance may begin CBP BI processing, which can take months.

A $10,000 signing bonus is available after 90 days under standard terms for candidates who already hold an active CBP BI and EOD.

Company

hirify.global provides cybersecurity and technology services supporting federal government missions.

What you will do

• Lead structured, hypothesis-driven threat hunts for a program supporting continuous U.S. Customs and Border Protection operations.
• Investigate activity that automated SOC detections may miss and confirm or rule out hypotheses using available environmental data.
• Convert confirmed hunt findings into production detection logic and tune detections as conditions change.
• Preserve evidence and context for actionable handoff to incident response and digital forensics leads.
• Translate threat intelligence and federal law enforcement threats into targeted hunting priorities.

Requirements

• Experience leading or performing structured threat hunting using a framework such as MITRE ATT&CK.
• Experience turning a threat-hunting finding into a production detection.
• Experience defending government or law enforcement data and environments.
• Ability to work with incomplete or ambiguous signals and assess which hypotheses are worth pursuing.
• Active CBP BI, a fitness determination at another DHS component, or an active DoD clearance is preferred.

Nice to have

• GCFA, GNFA, or an equivalent certification.

Culture & Benefits

• Health and life insurance options.
• Paid time off and holiday pay.
• Short-term and long-term disability coverage.
• Retirement benefits and learning and development opportunities.
• Values centered on helpfulness, honesty, humility, continuous improvement, and mission-driven execution.