Cyber Threat Analyst; TN

Job Summary
- Position Eligible for $10,000 Sign-on Bonus
- Subject to 12 Month Commitment

Newberry Group is seeking an experienced, analytical Cyber Threat Analyst to join our customer’s Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, HI. Operating under the Global Services Management
- Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, the mission is to defend the Department of Defense Information Network (DODIN/DISN), U.S. Pacific Command (USPACOM), and critical mission partner enclaves against sophisticated advanced persistent threats and nation-state cyber actors.

In this high-impact intelligence and analysis role, you will synthesize multi-source intelligence, telemetry, and forensic data into actionable threat intelligence. You will analyze adversary tactics, techniques, and procedures (TTPs), formulate threat indicators, track advanced adversary campaigns, and direct threat-informed defense operations across perimeter boundaries, multi-cloud platforms, and classified networks - spanning Unclassified (NIPRNet) and Secret (SIPRNet) up to Top Secret/SCI.

This is a full-time onsite role in Ford Island, HI. Telework is not permitted.

Relocation expenses may be eligible for reimbursement of up to $10,000.

DoD Active Top Secret clearance required with SCI Eligibility;
Secret clearance level may be acceptable with Government approval.

$115,000 to $150,000 annually - depending on experience and position level.

Yes, 10% of the time.

• Warning Intelligence & Attack Sensing: Analyze boundary sensor feeds, Netflow, and IDS/IPS logs in conjunction with intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
• Adversary Campaign Tracking: Apply the MITRE ATT&CK® and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify "Living off the Land" (LotL) tradecraft, and assess the operational impact of targeted threats traversing enterprise Internet Access Points and Boundary Cloud Access Points.
• Actionable Battlefield Intelligence: Author, refine, and disseminate high-impact, actionable battlefield cyber threat analysis products, Threat Warnings, and Tippers that empower tactical defenders and boundary engineers to preempt emerging cyber assaults.
• Automated Telemetry & Breach Assessment: Evaluate bypasses and telemetry from automated blocking platforms to uncover adversary evasion techniques, evaluate malicious patterns, and generate targeted analytic hypotheses.
• Operational Reporting & DJOC Synchronization: Coordinate closely with the DISA Joint Operations Center (DJOC), USPACOM J6, DoD Cyber Defense Command (DCDC), USCYBERCOM, and the National Security Agency (NSA) to synchronize threat analyses and maintain standardized incident reporting in the DoD-mandated reporting structure (currently Rally).

• Deliberate Defense (DD) & Discovery Counter Infiltration (DCI): Formulate threat hypotheses based on all-source intelligence, reconstruct multi-stage adversary attack paths, and conduct structured threat-hunting across enterprise endpoints and cloud enclaves to validate malicious presence or confirm its absence.
• Multi-Cloud & Zero Trust Threat Analysis: Track advanced persistent threats operating against enterprise cloud ecosystems (AWS Gov Cloud, Azure Government, Google Cloud Platform, Oracle Cloud Infrastructure) secured under the Joint Warfighter Cloud Capability, Thunderdome Zero Trust Network Access (ZTNA), and Microsoft Defender suite (End Guard).
• Analytic Capability & Use Case Development: Translate threat intelligence and adversary TTPs into specific detection use cases, rule logic, and detection requirements for ingestion into enterprise SIEMs (Splunk, Microsoft Sentinel, Elastic, and JCRS-D).
• Aggregated Threat Trend Reporting: Aggregate threat indicators, malware behaviors, and adversary profiles from commercial threat feeds (e.g., Crowd Strike, Virus Total) and internal investigations; provide inputs for the quarterly Aggregated Cyber Awareness Report detailing strategic threat forecasts and vulnerability exposures.
• Vulnerability & Exposure…