Threat Hunt Lead (CBP

About Agile Defense

At Agile Defense we know that action defines the outcome and new challenges require new solutions. That’s why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next.

Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility—leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation’s vital interests.

Title:

Threat Hunt Lead (CBP)

Clearance:
Active CBP Background Investigation (CBP BI) and EOD strongly preferred. We can begin processing for candidates who do not hold one.

Citizenship: U.S. Citizenship required

Location:

Ashburn, VA
- Hybrid

Salary Range: [pending]

Signing Bonus: $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply.

Travel:
Rare, as needed

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission are watched by automated detection around the clock, and automated detection only catches what it was built to catch. The gap between what a tool flags and what is actually happening in the environment is where a threat hunter works, and on a program supporting continuous federal law enforcement operations, that gap is not theoretical.

You lead threat hunting for this program. You will form and test hypotheses about activity the SOC's existing detections might be missing, dig into the environment to confirm or rule them out, and turn what you find into detections other analysts can rely on going forward. You will work closely with the Security Operations Center Manager and hand confirmed findings to the incident response and digital forensics leads.

One thing is worth knowing before you apply. Most hunts do not find anything, and that is not failure. A hunt that rules out a hypothesis honestly is doing its job. The people who do well here are comfortable being wrong most of the time in service of being right when it counts.

Objective 1:
Find what automated detection misses

• Hunts are grounded in a real hypothesis about adversary behavior, not a general look around for anything unusual.
• Confirmed findings represent activity that existing detections did not catch, which is the actual measure of whether hunting is adding value beyond the SOC's standing tools.
• You can explain why you ruled a hypothesis out, not just report that you did.

Objective 2:
Turn what you find into detection that outlives the hunt

• Confirmed findings become new detection logic, so the next occurrence gets caught automatically instead of requiring another manual hunt.
• Detection you build gets tuned as conditions change, rather than left as originally written.
• Other analysts can use what you built without needing you to explain it every time.

Objective 3:
Hand off findings clean enough to act on immediately

• When a hunt confirms real activity, incident response gets a finding they can act on without redoing your investigative work.
• Evidence and context are preserved well enough that digital forensics can pick up where you left off if a case needs that depth.
• You know when a finding needs to accelerate now versus when it can go through standard reporting.

Objective 4:
Keep the hunting program grounded in what actually threatens this environment

• Hunt hypotheses reflect the tactics that matter for a federal law enforcement environment, not a generic threat list.
• Threat intelligence gets translated into hunts that are specific enough to test, not left as a general…