Threat Hunt Lead (CBP)

Job Description

About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That’s why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation’s vital interests. Title: Threat Hunt Lead (CBP) Clearance: Active CBP Background Investigation (CBP BI) and EOD strongly preferred. We can begin processing for candidates who do not hold one. Citizenship: U.S. Citizenship required Location: Ashburn, VA - Hybrid Salary Range: [pending] Signing Bonus: $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply. Travel: Rare, as needed The Role U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. The gap between what a tool flags and what is actually happening in the environment is where a threat hunter works, and on a program supporting continuous federal law enforcement operations, that gap is not theoretical. You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads. One thing is worth knowing before you apply. Most hunts do not find anything, and that is not failure. A hunt that rules out a hypothesis honestly is doing its job. The people who do well here are comfortable being wrong most of the time in service of being right when it counts. What Success Looks Like Objective 1: Find what automated detection misses Hunts are grounded in a real hypothesis about adversary behavior, not a general look around for anything unusual. Confirmed findings represent activity that existing detections did not catch, which is the actual measure of whether hunting is adding value beyond the SOC's standing tools. You can explain why you ruled a hypothesis out, not just report that you did. Objective 2: Turn what you find into detection that outlives the hunt Confirmed findings become new detection logic, so the next occurrence gets caught automatically instead of requiring another manual hunt. Detection you build gets tuned as conditions change, rather than left as originally written. Other analysts can use what you built without needing you to explain it every time. Objective 3: Hand off findings clean enough to act on immediately When a hunt confirms real activity, incident response gets a finding they can act on without redoing your investigative work. Evidence and context are preserved well enough that digital forensics can pick up where you left off if a case needs that depth. You know when a finding needs to escalate now versus when it can go through standard reporting. Objective 4: Keep the hunting program grounded in what actually threatens this environment Hunt hypotheses reflect the tactics that matter for a federal law enforcement environment, not a generic threat list. Threat intelligence gets translated into hunts that are specific enough to test, not left as a general awareness exercise. You can say what you have not hunted for yet and why, rather than presenting coverage as complete. What You Bring Preferred Experience You have led or performed structured threat hunting, using a framework such as MITRE ATT&CK to form and test hypotheses, not only reviewed alerts as they arrived. You have turned a hunt finding into a production detection and can describe the process. You have worked in an environment defending against threats targeting government or law enforcement data, not only general commercial risk. You are comfortable working from incomplete or ambiguous signals and can describe how you decide when a hypothesis is worth pursuing. You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date. Certifications such as GCFA, GNFA, or equivalent are useful, but they are not a substitute for having found something real. A note on timing We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply. Employee Benefits Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections.