External Title Cyber Software Engineer

Responsibilities

Peratonseeks a Cyber Software Engineer
to support Army Cyber Command Defensive Cyberspace Operations (DCO).

Location:

Fort Gordon, GA

This is a hands-on, code-forward technical role. The selected candidate will author custom detection analytics and hunt tooling, execute proactive threat hunting operations across the DoDIN-A,and translate threat intelligenceinto operationalized detection logic — all in direct support of Defensive Cyberspace Operations.

The primary focus of this position is building and executing:writing Python-based analytics, developing Sigma rules, crafting complex SQL queries, and running those signatures against live telemetry toidentifyadversarial activity that evades traditional security boundaries. The candidate willalso query and synthesize reportingfrom Cyber Threat Intelligence (CTI) repositories — including government, OSINT, and commercial-leased CTI platforms — to source and vector threat hunting analytics. Findings must be documented and communicated at a level suitable for senior leadership and general officer briefings.

Tasks Include:

• Threat Hunting & Detection Engineering
  • Design, build, and implement advanced detection analytics using Python; integrate SQL queries into Python-based logic to correlate real-time telemetry with original threat research and adversarial TTPs as described by MITRE ATT&CK®.
  • Execute proactive cyber threat hunting operations across theDoDIN-A using custom-developed analytics; actively search for andidentifyadversarial artifacts, anomalies, Indicators of Attack (IOAs), and Indicators of Compromise (IOCs) that evade traditional security boundaries.
  • Translate threat reporting into high-fidelity detection logic; develop and maintain Sigma rules and translate those rules into complex SQL queries tailored to specific data repositories.
  • Develop SIEM-based analytics toidentifyadversaries' behaviors, goals, and methods; pinpoint gaps within theDoDIN-A security boundary that adversaries may be exploiting.
  • Review and analyze data feeds to ensure relevance and synchronization with DCO priorities.
• CTI Synthesis & Reporting
  • Query and synthesize technical cybersecurity reporting from government, OSINT, IC, and commercial-leased CTI repositories toidentifyspecific technical indicators and behaviors that correlate with assigned ATT&CK Techniques, sourcing and vectoring analytic development.
  • Draft comprehensive operational notes and hunt findings; articulate complex technical data and cybersecurity risks at a levelappropriate forsenior leadership and general officer briefings.
  • Use advanced data visualization techniques to distill complex technical datasets into clear, actionable presentations for audiences with varied levels of understanding of complex technical topics.
  • Communicate complex cybersecurity insights through briefings, reports, and visualization tools.
  • Create andmaintaincontinuity documents necessary for team members to produce contractual deliverables.

Required:

• Minimum of 8 years with BS/BA;
  Minimum of 6 years with MS/MA;
  Minimum of 3 years with PhD. Will consider 10 years with Associates degree or 12 years with HS.
• Advanced coding fluency in Python, withdemonstratedability to build data-driven security analytics and custom hunt tooling.
• Highproficiencyin data querying and logic development using SQL, and Sigma rule creation.
• Intimate, practical knowledge of MITRE ATT&CK Enterprise framework and its application in mapping adversarial TTPs to defensive analytics.
• Demonstrated ability to query, navigate, and extract actionable intelligence from CTI repositories — including commercial-leased platforms — to source and inform threat hunting operations.
• Deep understanding ofcyber attackvectors, vulnerability exploitation, and network defense principles to support continuous DCO priorities.
• Exceptional professional writingcapabilities;must be able to synthesize highly technical hunt findings into clear, concise, and academically rigorous reports for executive-level (Army Cyber Command) consumption.
• Effective communication and collaboration skills to ensure team responsiveness and data feed relevance to DCO priorities.
• Requires at least one of…