Cyber Threat Intelligence Lead

**This position is contingent upon contract award**

SOSi is seeking highly qualified senior professionals to support a DHS enterprise cybersecurity program providing 24/7 Security Operations Center (SOC) services. These roles deliver leadership, operational oversight, and technical expertise across cyber defense, incident response, intelligence, engineering, and modernization activities.

Job Description

Directs cyber threat intelligence collection, analysis, production, and integration into SOC workflows; maintains situational awareness of threat actors, TTPs, and campaigns to inform detection content, hunt priorities, and leadership decisions.

Responsibilities

• Develop actionable intelligence products, IOCs, and early-warning assessments supporting operations.
• Integrate CTI with detection engineering and hunt teams; drive signature/rule/content development.
• Maintain threat actor tracking, trends/metrics, and leadership reporting.

Qualifications

• Experience: 
  • Seven (7) years experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis.
  • A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host-based and network based security monitoring using cybersecurity capabilities.
  • Possess a strong cyber security background with experience in: host-based and network based forensics related to the identification of advanced cyber threat activities, intrusion detection, incident response, malware analysis, and security content development (e.g., signatures, rules, etc.); and cyber threat intelligence.
  • Experience in developing scripts to support cyber threat detection that outputs results in a variety of formats, such as VB scripts, Python, C++, and HTML, XML or other type most appropriate for the task. 
  • Experience in conducting cyber threat analysis, identifying mitigation and/or remediation courses of action; developing actionable intelligence used to protect organizational IT assets; and trending cyber threat metrics for leadership situational awareness.
  • Experience in maintaining a comprehensive understanding of the cyber threat landscape, including identifying and analyzing cyber threats actors and/or activities to enhance cybersecurity posture of the organization’s IT operating environment.
• Certifications: CISSP
• Clearance: TS, SCI-eligible.

Additional Information

Work Environment

• Normal office conditions with potential to perform duties in various CONUS locations.
• Core hours of operation are Monday through Friday, 0600 – 1700.
• May be requested to work evenings and weekends to meet program and contract needs.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.