Cyber Hunt Team Operator — CYBERCOM SOC Operations

CYBERCOM's SOC recompete includes dedicated hunt team augmentation — proactive threat hunting across DODIN-connected networks, not reactive incident response. This is offensive-minded defensive work: you're looking for adversary TTPs before the alarm triggers.

What You'd Be Doing

Hunt missions are assigned by CYBERCOM's CNMF (Cyber National Mission Force) operations staff. You'll develop hunt hypotheses based on current threat intelligence, execute across available sensor platforms, and document findings in a format that feeds finished intelligence production. DFIR (Digital Forensics and Incident Response) experience is a baseline; experience with APT-level threat actors relevant to CYBERCOM's mission set is the competitive differentiator.

Why Position Yourself Now

Hunt team talent is the tightest cleared specialty in the market. Companies bidding this contract are not waiting for RFP release to build their proposed teams — they are recruiting now. A cleared hunt operator who contacts the BD teams at Peraton or SAIC in Q2 2026 will be named in the proposal, not sourced after award.

Clearance Note

TS/SCI minimum; CI polygraph preferred for some hunt mission roles. GREM, GCFE, or GCFA certifications are weighted positively in the CYBERCOM technical evaluation framework.