SITEC - Cyber Intelligence Fusion Analyst - MacDill AFB

Peraton requires a Cybersecurity Analyst to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM.  This position is located at MacDill AFB in Florida.

The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. 

This Cybersecurity Analyst position will functionally perform the duties of a Cyber Intelligence Fusion Analyst and is responsible for synthesizing Cyber Threat Intelligence (CTI) with internal operational telemetry to identify and anticipate adversarial activities. The primary objective of this role is to translate complex intelligence into actionable, hypothesis-driven threat hunting packages, and to support ongoing incident investigations with actionable intelligence. By bridging the gap between intelligence gathering and network defense, this analyst empowers cyber threat hunting and incident response teams to proactively detect, isolate, and neutralize advanced persistent threats (APTs) targeting mission-critical infrastructure.

• Lead the CTI fusion process to drive the development of comprehensive adversarial hunt and deterrence plans.
• Provide mentorship, technical guidance, and operational leadership to junior cyber analysts and threat hunters executing established hunt plans.
• Execute complex or high-priority threat hunts alongside the Defensive Cyber Operations (DCO) team when required, leveraging deep technical expertise to isolate and neutralize threats.
• Correlate external threat intelligence with internal network, endpoint, and system data to identify potential vulnerabilities, capability gaps, or active exploitation.
• Develop comprehensive, hypothesis-based threat hunting packages tailored to specific adversary tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs).
• Map adversarial behaviors and threat intelligence reporting to the MITRE ATT&CK framework to ensure standardized threat modeling.
• Collaborate directly with DCO teams to refine hunt methodologies, provide tactical intelligence support during active hunts, and interpret results for strategic deterrence.
• Produce and disseminate timely intelligence reports, briefings, alerts and products to tactical operators and strategic leadership.
• Maintain continuous awareness of the evolving cyber threat landscape, particularly focusing on adversaries targeting national security and Department of War (DoW) networks.

Required Qualifications:

• Min 12 years with HS Diploma, 10 years AS/AA degree, 8 years with BS/BA degree, 6 years MS/MA, 3 years with PhD
• A DoD TS/SCI clearance is required
• DoD 8570 IAT II certifications AND
• CEH OR
• CFR OR
• CCNA Cyber Ops OR
• CCNA-Security OR
• CySA+ OR
• CHFI OR
• GCIA OR
• GCIH OR
• GCFA OR
• GICSP OR
• Cloud + OR
• SCYBER OR
• PenTest +

Desired Qualifications:

• Hands-on, advanced experience executing cyber threat hunts, incident response, or defensive cyber operations.
• Strategic mindset capable of synthesizing tactical hunt results and intelligence into broader adversarial deterrence strategies.
• Strong understanding of the cyber threat intelligence lifecycle and established analytical methodologies (e.g., Diamond Model of Intrusion Analysis, Lockheed Martin Cyber Kill Chain, MITRE ATT&CK).
• Demonstrated capability to translate complex intelligence reporting into actionable hunt hypotheses, queries, and operational packages.
• Familiarity with enterprise defense telemetry, Security Information and Event Management (SIEM) platforms (e.g., Splunk, Elastic), and Endpoint Detection and Response (EDR) solutions.
• In-depth knowledge of network protocols, operating system internals (Windows, Linux, macOS), and common adversary evasion techniques.
• Excellent written and verbal communication skills, with the ability to brief technical intelligence findings to both tactical operators and senior leadership clearly and concisely.