Cyber Software Engineer Security Clearance

Position: Cyber Software Engineer with Security Clearance
Location: Fort Gordon

About Peraton Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace.

The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit  to learn how we're keeping people around the world safe and secure. About

The Role Peraton seeks a Cyber Software Engineer to support Army Cyber Command Defensive Cyberspace Operations (DCO).

Location:

Fort Gordon, GA This is a hands-on, code-forward technical role. The selected candidate will author custom detection analytics and hunt tooling, execute proactive threat hunting operations across the DoDIN-A, and translate threat intelligence into operationalized detection logic - all in direct support of Defensive Cyberspace Operations. The primary focus of this position is building and executing: writing Python-based analytics, developing Sigma rules, crafting complex SQL queries, and running those signatures against live telemetry to identify adversarial activity that evades traditional security boundaries.

The candidate will also query and synthesize reporting from Cyber Threat Intelligence (CTI) repositories - including government, OSINT, and commercial-leased CTI platforms - to source and vector threat hunting analytics. Findings must be documented and communicated at a level suitable for senior leadership and general officer briefings. Tasks Include:
* Threat Hunting & Detection Engineering
* Design, build, and implement advanced detection analytics using Python; integrate SQL queries into Python-based logic to correlate real-time telemetry with original threat research and adversarial TTPs as described by MITRE ATT&CK®.
* Execute proactive cyber threat hunting operations across the DoDIN-A using custom-developed analytics; actively search for and identify adversarial artifacts, anomalies, Indicators of Attack (IOAs), and Indicators of Compromise (IOCs) that evade traditional security boundaries.
* Translate threat reporting into high-fidelity detection logic; develop and maintain Sigma rules and translate those rules into complex SQL queries tailored to specific data repositories.
* Develop SIEM-based analytics to identify adversaries' behaviors, goals, and methods; pinpoint gaps within the DoDIN-A security boundary that adversaries may be exploiting.
* Review and analyze data feeds to ensure relevance and synchronization with DCO priorities.
* CTI Synthesis & Reporting
* Query and synthesize technical cybersecurity reporting from government, OSINT, IC, and commercial-leased CTI repositories to identify specific technical indicators and behaviors that correlate with assigned ATT&CK Techniques, sourcing and vectoring analytic development.
* Draft comprehensive operational notes and hunt findings; articulate complex technical data and cybersecurity risks at a level appropriate for senior leadership and general officer briefings.
* Use advanced data visualization techniques to distill complex technical datasets into clear, actionable presentations for audiences with varied levels of understanding of complex technical topics.
* Communicate complex cybersecurity insights through briefings, reports, and visualization tools.
* Create and maintain continuity documents necessary for team members to produce contractual deliverables. Qualifications

Required:

* Minimum of 8 years with BS/BA;
Minimum of 6 years with MS/MA;
Minimum of 3 years with PhD. Will consider 10 years with Associates degree or 12 years with HS.
* Advanced coding fluency in Python, with demonstrated ability to build data-driven security analytics and custom hunt tooling.

* High proficiency in data querying and logic development using SQL, and Sigma rule creation.
* Intimate, practical knowledge of MITRE ATT&CK Enterprise framework and its application in mapping adversarial TTPs to defensive analytics.
* Demonstrated ability to query, navigate, and extract actionable intelligence from CTI repositories - including commercial-leased platforms - to source and inform threat hunting operations.
* Deep understanding of cyber attack vectors, vulnerability exploitation, and network defense principles to support continuous DCO priorities.

* Exceptional professional writing capabilities; must be able to synthesize highly technical hunt findings into clear, concise, and academically rigorous reports for executive-level (Army Cyber Command) consumption.

* Effective communication and collaboration skills to ensure team responsiveness and…