Senior ICS Threat Analyst​/Top Secret

Position: Senior ICS Threat Hunt Analyst / Active Top Secret
Responsibilities Peraton is currently hiring Senior ICS Threat Hunt Analysts for its Federal Strategic Cyber programs.

Location:

Arlington, VA (On-site)
In this role, you will:

Lead proactive threat hunting operations across OT/ICS environments, developing hunt hypotheses based on adversary TTPs, vulnerability disclosures, and intelligence reporting.

Serve as subject matter expert (SME) for ICS security activities, including internet-facing asset exposure analysis, OT network architecture review, and threat landscape assessments.

Leverage advanced reconnaissance and asset discovery platforms (e.g., Shodan, Censys, Zoom Eye) to map critical infrastructure attack surfaces and identify systemic risks.

Conduct in-depth analysis of ICS communication protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm, PROFINET) to identify anomalies, misconfigurations, and indicators of adversary activity.

Fuse multiple intelligence sources to develop products, recommendations, and inform priorities for the organization.

Perform research and investigate current threats in operational technology, specific critical infrastructure sectors, and mission areas to inform senior leaders and drive priorities for operational teams, including forward-deployed incident response and threat hunting functions.

Analyze collected data to derive facts and projections concerning adversary capabilities, intentions, and attack approaches—research resource allocations, motivations, tendencies, and contribute to profiling adversarial behavior with respect to critical infrastructure system attacks.

Prepare assessments and cyber threat profiles of current events and trends within ICS/SCADA environments.

Escalate new or high-priority threats to the Cyber Physical Forensics Section as required.

Map ICS threat activity using the MITRE ATT&CK for ICS Framework.

Seamlessly work alongside a team of host, network, and cloud forensic analysts to meet mission requirements for both incident response and threat hunting engagements.

Develop and maintain analytical procedures, hunt playbooks, and tradecraft documentation to meet evolving mission requirements.

Identify potential open-source vulnerabilities existing within ICS/SCADA systems and assess exploitability in the context of real-world threat actor capabilities.

Identify classified threat intelligence reporting related to ICS/SCADA and analyze for adversary intent and capability.

Lead development of Pre-Deployment Readiness Packages and campaign tracking.

Produce high-quality papers, presentations, recommendations, and findings for senior U.S. government intelligence and operations officials.

Serve as a customer-facing SME supporting technology adoption and ICS security strategy.

Qualifications

Basic Qualifications:

Bachelor's degree and 8 years of experience, or an Associate's degree and 10 years, or HS and 12+ years of experience in lieu of a degree

Hands-on experience with Industrial Control Systems (ICS), Operational Technology (OT), and/or Supervisory Control and Data Acquisition (SCADA) systems, and the underlying principles necessary to ensure security and safe function of ICS systems

Demonstrated experience leading or conducting threat hunt operations, network reconnaissance, or adversary emulation in IT or OT environments

Proficiency with internet-facing asset discovery and reconnaissance platforms (e.g., Shodan, Censys, Zoom Eye) for identifying and assessing exposed critical infrastructure

Strong understanding of ICS/SCADA protocols (e.g., Modbus, DNP3, BACnet, OPC UA, Ethernet/IP, S7comm, PROFINET) and their security implications

Advanced understanding of networking concepts (TCP/IP stack, routing, switching, network segmentation, firewalls, IDS/IPS) and their application in IT/OT…