AOUSC - CTI Lead

CTI Lead

cFocus Software seeks a CTI Lead to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.

Qualifications:

• Active Public Trust clearance
• B.S. Computer Science, Information Technology, or a related field
• 5+ years' experience in conducting in-depth technical analysis of cyber threats, including malware, phishing campaigns, and other attack vectors.
• 5+ years' experience in collecting and aggregating threat intelligence from various sources, such as opensource intelligence (OSINT), dark web forums, and commercial threat intelligence feeds. This includes evaluating the credibility and relevance of intelligence sources and identifying actionable intelligence for the organization.
• 5+ years' experience in producing written and oral reports, briefings, and presentations to communicate threat intelligence findings, assessments, and recommendations to stakeholders (executives).
• 5+ years' experience using cybersecurity tools and technologies for threat intelligence analysis, such as threat intelligence platforms (TIPs), SIEM systems, and malware analysis tools.
• Active GCTI or relevant vendor Cyber Threat Intelligence certification, such as Mandiant Cyber Threat Intelligence Analysis Certification

Duties:

• Lead Cyber Threat Intelligence operations supporting AOUSC Security Operations Division (SOD) mission objectives and 24x7x365 cybersecurity operations.
• Proactively identify, analyze, and operationalize cyber threat intelligence using external intelligence feeds, federal partner reporting, open-source intelligence (OSINT), vendor intelligence platforms, and internal telemetry.
• Conduct advanced analysis of cyber threat actors, campaigns, malware, phishing activity, suspicious infrastructure, and adversary TTPs impacting Judiciary systems and networks.
• Develop intelligence-driven assessments regarding emerging threats, attack trends, vulnerabilities, and cyber risks affecting Judiciary operations.
• Coordinate intelligence support for active cybersecurity incidents and provide actionable intelligence products to Incident Response (IR), Cybersecurity Triage, Threat Hunting, and Detection Engineering teams.
• Respond to and resolve CTI support requests from Security Operations teams within established Service Level Agreements (SLAs).
• Develop and maintain the Cyber Threat Intelligence Execution Plan aligned to identified threat vectors, organizational risk, and government priorities.
• Correlate indicators of compromise (IOCs), attack patterns, adversary infrastructure, and telemetry to identify malicious activity and support operational decision-making.
• Perform proactive intelligence analysis to identify potential threats and suspicious activity within Judiciary systems, networks, and cloud environments.
• Develop Tactical Threat Intelligence Reports supporting ongoing cybersecurity investigations, incident response operations, and executive awareness.
• Produce detailed CTI Reports containing analysis of patterns, trends, indicators, vulnerabilities, adversary methodologies, and recommendations for improved detections and defensive actions.
• Develop executive-level CTI Sprint Reports summarizing threat activity, intelligence findings, operational impacts, emerging risks, and strategic recommendations.
• Provide recommendations regarding changes to risk levels for Judiciary systems based on vulnerabilities, emerging threats, intelligence reporting, and active exploitation activity.
• Collaborate closely with Threat Hunting and Detection Engineering teams to improve telemetry coverage, detection logic, logging visibility, and threat detection capabilities.
• Support development and operationalization of intelligence-driven threat models and risk assessments tailored to Judiciary environments and high-value assets.
• Perform intelligence analysis utilizing Splunk Enterprise Security, Microsoft Sentinel, Splunk SOAR, CrowdStrike, Qualys, ServiceNow, Jira, Recorded Future, Google Threat Intelligence, Cisco Threat Grid, and related cybersecurity tools.
• Prepare and present technical briefings, operational updates, intelligence reports, and executive presentations to AO leadership and federal stakeholders.
• Maintain documentation, standard operating procedures (SOPs), intelligence methodologies, and operational processes in accordance with AO standards and NIST guidance.
• Provide mentorship, technical guidance, and quality oversight to CTI analysts and supporting cybersecurity personnel.
• Support transition-in, transition-out, operational readiness, and knowledge transfer activities in accordance with AO requirements.