About this opportunity
ECS lists this Cyber Threat Intelligence (CTI) SME (Team Lead) opportunity in arlington, Virginia. Review the employer’s description below for duties, qualifications and application requirements.
Job description
Job Description
Everforth ECS is seeking a Cyber Threat Intelligence (CTI) SME (Team Lead) to join our team in Arlington, VA (Hybrid) . This position is contingent upon award.
ECS is seeking a CTI SME (Team Lead) to lead a specialized cyber threat collection and analytics capability within Threat Branch in support of our National Security client. The scope of the program includes designing, implementing, and operating a tailored collection and analytics framework to convert diverse external datasets into precise, actionable leads for Proactive Threat Hunting (PHB) and Incident Response (IRB) teams. This position is located in Ballston, VA (Arlington) with the option for routine remote work. In this role, you will lead a highly technical team of threat analysts and engineers delivering advanced threat intelligence, tracking priority PRC adversaries, and deploying automation-first analytics pipelines.
We are seeking an accomplished, dynamic, and hands-on CTI leader with experience managing technical threat intelligence capabilities in a fast-paced environment. The role requires strong technical authority and leadership to establish a unified intake-to-execution workflow that gives stakeholders visibility into intelligence requests, analytics outputs, and service delivery validated against operational needs. Your ability to build high-confidence behavioral fingerprints, map procedure-level actor behaviors to MITRE ATT&CK, and correlate disparate telemetry datasets will be critical to your success.
Salary Range: $165,000 - $185,000
Required Skills
10+ years of progressive experience in Cyber Threat Intelligence (CTI), threat hunting, or threat analysis roles, including experience leading technical teams.
Active Top Secret Clearance with SCI eligibility.
Demonstrated expertise tracking priority threat actors (including PRC state-sponsored adversaries), victim-facing infrastructure, relay/proxy networks, and obfuscation setups.
Deep hands-on experience developing high-confidence signatures, fingerprints, and heuristics (e.g., TLS/HTTP behavioral fingerprints, domain/IP clustering).
Technical proficiency mapping adversary behaviors at the procedure level to the MITRE ATT&CK framework and producing clear hunt/detection guidance.
Proven capability correlating diverse external datasets (e.g., internet-wide scans, commercial decoy feeds) with internal telemetry and sensor data to drive high-value hunt leads.
Experience designing and implementing automation-first analytics pipelines, including integrating AI/ML models (e.g., clustering, anomaly detection) with human-in-the-loop validation workflows.
Experience establishing intake-to-execution workflows to align service models, budgets, and request tracking directly with user operational needs.
Desired Skills
GIAC Cyber Threat Intelligence (GCTI), Certified Information Systems Security Professional (CISSP), or equivalent technical certifications.
Experience managing DHS or CISA cybersecurity programs (specifically supporting PHB, IRB, EOS, or Unified Persistent Hunt stakeholders).
Expertise in evaluating commercial threat feeds and external context providers (e.g., GreyNoise, residential proxy/TOR context feeds) to deliver signal-to-noise and cost-benefit assessments.
Proven track record of integrating CTI analytics outputs into enterprise target toolsets (e.g., "single pane of glass" dashboards).
In-depth knowledge of evolving threat actor tactics, techniques, and procedures (TTPs) and advanced data-driven correlation methodologies.
#EverforthECS1
ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, or local jurisdiction law.
Everforth ECS is the federal segment of Everforth, a $4B global organization with over 10,000 employees. Our nearly 3,500 professionals deliver advanced technology solutions in data and AI, cybersecurity, and enterprise transformation, serving defense, intelligence, and federal civilian agencies.
Our work powers mission-critical outcomes, strengthens technology partnerships, and creates meaningful opportunities for our people. We are defined by a commitment to excellence in delivery, a culture of innovation, and an environment where talent can thrive and grow.
We Value
Attracting and developing top talent and high-performing teams
Fostering a culture that is engaging, accountable, and mission-driven
Meet the challenge. Make a difference with Everforth ECS!
#J-18808-Ljbffr
Worksite address
arlington, VA, 22201, US
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.