External Title ICS Threat Analyst​/Top Secret

Responsibilities

Peraton is currently hiring
Industrial Control System Cyber Threat Intelligence Analyst
for its Federal Strategic Cyber programs.

Location:
On-site role in Arlington, VA.

In this role, you will:

• Conduct proactive threat hunting across operational technology (OT) and industrial control system (ICS) environments to identify adversary presence, misconfigurations, and indicators of compromise.
• Leverage internet-facing asset discovery and reconnaissance platforms (e.g., Shodan, Censys) to identify exposed ICs/SCADA assets, assess attack surface, and inform threat assessments.
• Perform open-source intelligence (OSINT) research and analysis to identify current and emerging threats targeting critical infrastructure sectors.
• Analyze network traffic patterns, ICs communication protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm), and system architectures to identify anomalous or malicious activity.
• Fuse multiple intelligence sources to develop products, recommendations, and inform priorities for the organization.
• Research and investigate current threats in operational technology, specific critical infrastructure sectors, and mission areas to inform senior leaders and drive priorities for operational teams, including forward-deployed incident response and threat hunting functions.
• Prepare assessments and cyber threat profiles of current events and trends within ICs/SCADA environments.
• Escalate new or high-priority threats to the Cyber Physical Forensics Section as required.
• Map ICs threat activity using the MITRE ATT&CK for ICs Framework.
• Seamlessly work alongside a team of host, network, and cloud forensic analysts to meet mission requirements for both incident response and threat hunting engagements.
• Identify potential open-source vulnerabilities existing within ICs/SCADA systems and assess exploitability in the context of real-world threat actor capabilities.
• Identify classified threat intelligence reporting related to ICs/SCADA and analyze for adversary intent and capability.
• Contribute to Pre-Deployment Readiness Packages and campaign tracking.
• Produce high-quality papers, presentations, recommendations, and findings for senior U.S. government intelligence and operations officials.

• Bachelor's degree and 2 years of experience, or an Associate's degree and 4 years of relevant experience; or HS and 6+ years in lieu of a bachelors degree.
• Demonstrated experience conducting threat hunting, network reconnaissance, or vulnerability assessment in IT or OT environments.
• Familiarity with IC/SCADA systems, protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP), and their associated security risks.
• Hands-on experience with internet-facing asset discovery tools such as Shodan, Censys, or similar platforms for identifying exposed infrastructure.
• Experience performing open-source intelligence (OSINT) collection and analysis to support cyber threat assessments.
• Understanding of networking fundamentals (TCP/IP, routing, switching, firewalls, VPNs) and how they apply to IT/OT convergence environments.
• Experience researching and analyzing cyber threats across either a) multiple industries or b) multiple time frames, including but not limited to critical infrastructure sectors.
• Familiarity with common cyber threat intelligence tools such as Domain Tools, Virus Total, Maltego, exploit-db, etc..
• Experience producing and completing all-source (unclassified and classified) finished intelligence assessments that adhere to ICD
  203 analytic tradecraft standards.
• Proven ability to collaborate and establish key threat intelligence partnerships to bolster information sharing and defenses.
• U.S. citizenship required.
• An Active Top Secret Security Clearance with SCI eligibility.
  • Additionally, have the ability to obtain/maintain DHS EOD agency clearance prior to starting

Certifications (any of the following):

• SANS GIAC Global Industrial Cyber Security Professional (GICSP)
• SANS GIAC Response and Industrial Defense (GRID)
• SANS GIAC Cyber Threat Intelligence (GCTI)
• SANS GIAC Certified Enterprise Defender (GCED)
• SANS GIAC Network Forensic Analyst (GNFA)
• SANS GIAC Certified…