Position Summary

The OT Threat Hunt Analyst supports critical infrastructure security operations by conducting intelligence-driven threat hunts, advanced host/network analysis, and detection development across both OT and enterprise environments. This role applies multi-source cyber threat intelligence, adversary behavior analysis, and cloud-based analytical platforms to identify, characterize, and mitigate threats impacting transmission, generation, and control center systems. The analyst collaborates closely with stakeholders across cybersecurity, intelligence, and operations teams to deliver actionable insights and strengthen defensive postures.

Key Responsibilities

• Lead and support threat hunt operations within OT environments, including substations, control centers, and enterprise networks.
• Perform in-depth host and network log analysis using platforms such as Elastic, Splunk, Malcolm, Wireshark, and forensic toolkits.
• Evaluate, translate, and apply multi-source threat intelligence to identify adversary techniques, impacted systems, and detection opportunities.
• Develop threat hunt packages, methodologies, and documentation to support systematic, intelligence-driven hunt activities.
• Engineer, test, and deploy sensor architectures in OT/ICS environments without disrupting critical operations.
• Conduct adversary behavior research using frameworks such as MITRE ATT&CK, Diamond Model, and ICS Cyber Kill Chain.
• Produce comprehensive threat assessments, analytic reports, and executive-level briefings summarizing findings, risks, and recommendations.
• Collaborate with intelligence community partners and enterprise cyber defenders to enhance detection, response, and situational awareness.
• Mentor junior analysts on OT architectures, data collection techniques, and threat hunting tradecraft.
• Support research using Mandarin language capabilities for specialized intelligence operations.

• Active TS/SCI with the ability to obtain a Q//SCI.
• Min 12 years with BS/BA, Min 10 years with MS/MA, Min 7 years with PhD, 16 years with a HS diploma
• Experience in cyber threat hunting, cyber intelligence, digital forensics, or OT/ICS security operations.
• Extensive experience with OT/ICS environments within critical infrastructure sectors.
• Proficiency with SIEM, detection, and forensic platforms: Elastic, Splunk, FTK, Wireshark, IBM Analyst’s Notebook.
• Strong background in host/network log analysis and adversary technique identification.
• Practical cloud experience using AWS and Microsoft Azure.
• Working knowledge of MITRE ATT&CK, ICS Cyber Kill Chain, and modern detection engineering practices.
• Ability to produce detailed analytic reports and executive briefings.
• US Citizenship.

Preferred Qualifications

• Bachelors or Masters in Cybersecurity Technology or related degree field.
• GIAC certifications such as GCFA, GCIH, or GCDA.
• Experience with detection engineering, incident response, continuous monitoring, and SIEM analytics.
• Experience supporting Intelligence Community and DoD cyber missions.
• Mandarin language proficiency is a significant plus.
• Experience documenting standardized analytic procedures and knowledge management practices.