Cybersecurity Principal Specialist - Hunt Host #4150

Target Hiring Range: $158,000–$178,000

Department: Chief Information Officer

Posting Date Range: 8/7/2026-8/21/2026

Pay Grade Range: $143,516 - $194,617

Work Hours: 1:45 p.m. - 10:15 p.m.

FLSA Status: Exempt

Work Location Status: Hybrid

Hybrid Schedule: 2-3 days a week onsite

All remote or hybrid work arrangements must be performed from within the continental United States, subject to Sergeant at Arms approval.

The Senate Sergeant at Arms does not pay for relocation expenses.

This vacancy announcement closes at 11:59pm EST. Late applications will not be accepted.

Job Overview

The Target Hiring Range for this position is: $158,000–$178,000

Cybersecurity Principal Specialist - Threat Hunt & Incident Response – Host Forensics

Department

Cybersecurity Operations Branch, Cybersecurity Threat Hunt & Incident Response Team.

The Sergeant at Arms plays a crucial role in upholding the operational integrity of the Senate community. Our vision is to foster an environment of innovation, collaboration, and adaptability, ensuring uninterrupted legislative proceedings irrespective of time, place, or circumstance. The Cybersecurity department is responsible for protecting the systems and information used to create the legislation that underwrites our democracy. We create a resilient cybersecurity operation by pro-actively identifying, protecting, detecting, reacting, and recovering (IPDRR) the US Senate enterprise. We combine people, processes, and technology into a state of the art, continuous risk-reduction practice that is flexible, innovative, and effective.

Role Overview

The Threat Hunt & Response Specialist serves as a senior technical subject matter expert within the Cybersecurity Threat Hunt & Response Team, operating at the front‑of the Senate’s cyber defense mission. This is a high‑tempo, always‑on role demanding deep expertise across two equally critical disciplines: host forensics and threat hunting, underpinned by hands‑on incident response leadership. In this role, you will lead proactive, hypothesis‑driven hunts across the enterprise, leveraging deep knowledge of host‑based artifacts, endpoint telemetry, memory forensics, and operating system endpoint detection and response tools to surface stealthy threats before they escalated. Working closely with both offensive and defensive security teams, you will translate findings into new monitoring and detection capabilities, ensuring the Senate’s cybersecurity posture continuously improves through every engagement. When incidents occur, you will serve as the senior technical lead, driving rapid containment and root cause analysis with a strong emphasis on host‑layer evidence, while producing actionable threat intelligence and meaningful reporting to strengthen the organization’s overall security posture.

Key Responsibilities

As a Threat Hunt & Incident Response Principal Specialist, your role is crucial in protecting our organization’s digital assets and supporting our cybersecurity initiatives. Your key responsibilities include:

• Threat Hunting – Lead proactive, hypothesis‑driven threat hunts across the enterprise to identify stealthy, undetected, or emerging threats. Leverage adversary TTPs, threat intelligence, and behavioral analytics — with a particular focus on host‑based evidence — to develop and execute hunting hypotheses. Document findings, refine methodologies, and translate hunt results into actionable detections and intelligence products.
• Host Forensics & Analysis – Serve as the team’s senior host forensics subject matter expert. Conduct in‑depth examination of host‑based artifacts including registry entries, file system metadata, prefetch files, event logs, shell history, and memory to reconstruct attacker activity, identify persistence mechanisms, and establish detailed timelines of compromise. Leverage tools such as Velociraptor, Volatility, FTK, and Autopsy to build a complete picture of adversary behavior at the endpoint and system level.
• Incident Response – Lead and coordinate responses to complex cybersecurity incidents, including malware infections, data breaches, insider threats, and advanced persistent threats (APTs). Serve as incident commander during major security events, ensuring timely communication, effective decision‑making, and cross‑team coordination with SOC, threat intelligence, vulnerability management, IT operations, legal, and compliance teams. Perform in‑depth forensic analysis of systems, networks, logs, and endpoint data to determine root cause, scope, and impact. Produce clear, detailed incident reports, post‑incident reviews, and executive‑level briefings.
• Detection Engineering – Use technical expertise and deep understanding of adversary TTPs to design, develop, and implement custom host‑based detections that address gaps in the current detection posture. Deploy and tune detections across endpoint, host, and cloud environments — leveraging EDR platforms, SIEM, and log analytics — ensuring fidelity, coverage, and operational usability. Continuously refine detection logic based on hunt findings, incident learnings, and emerging threat intelligence.
• Leadership & Mentorship – Mentor and guide junior threat hunters and incident responders, elevating the team’s overall technical capability. Develop, refine, and execute threat hunt and incident response playbooks, procedures, and escalation processes. Identify gaps in detection and response capabilities and champion improvements to tools, processes, and controls.

Key Accountabilities/Essential Job Duties

• Provides functional and/or technical skills for the assigned cybersecurity unit. Supports the unit’s work effort as required in preparing materials for collaborating with other sections, divisions, departments, and vendors to gather and disseminate information. Contributes to the unit’s work effort as required in preparing analysis and materials for providing expert level support in the assigned area of cybersecurity to SAA IT security branch staff, other SAA technical staff, SAA procurement staff, and other division or departments; and for identifying and resolving critical and complex issues in the assigned unit. Supports the unit’s work effort as directed in providing leadership to the unit’s project teams and contractors. Work includes helping to develop plans, assignments, and coordination of work efforts. Supports the unit’s work effort to develop governing policies, standards, and procedures. Other duties as assigned.

Job Specifications

Required Education

High School Diploma, GED

Required Work Experience

• Seven to ten years of progressively responsible experience in cybersecurity, with a track record of leading initiatives to resolve highly complex cybersecurity issues. Subject matter expertise in one or more cybersecurity domains. Strong leadership skills, including experience managing project teams and coordinating efforts across multiple departments. Demonstrated ability to develop and implement strategic cybersecurity policies, standards, and frameworks that align with organizational goals.

Working Conditions

• This position directly supports essential services of the U.S. Senate. As such, this position requires the employee be available and prepared to work during a government lapse in appropriations , in inclement weather, on holidays, weekends, and during late nights to ensure essential services to the Senate continue without interruption. In the context of government furloughs, this position is considered excepted.
• The U.S. Senate network cannot be taken offline for maintenance during the workday, or while the Senate is in session. As such, maintenance windows may only occur at night, on weekends, and occasionally on holidays. Employees who perform systems upgrades, maintenance, wiring, backups, support our alternate data centers will have schedules that include working nights, weekends, and holidays
• Sedentary
• This position may require the incumbent to be available for sudden recall in response to emergency events affecting the Senate campus/community, which may include after‑hour or weekend work, and to potentially deploy to alternate sites in support of the Senate’s contingency operations. (TCR).

Security Clearance

• This position requires that the applicant obtain and maintain a Secret U.S. Government security clearance.
• Applicants must be U.S. citizens in order for the SAA to submit your application for a security clearance.

CONDITIONS OF EMPLOYMENT

• Be a U.S. citizen;
• Be lawfully admitted for permanent residence and seeking citizenship as outlined in 8 U.S.C.1324b(a)(3)(B);
• Be (i) admitted as a refugee under 8 U.S.C.1157 or granted asylum under 8 U.S.C.1158 and (ii) have filed a declaration of intention to become a lawful permanent resident and then a citizen when eligible; or
• Owe allegiance to the U.S. (i.e., qualify as a non-citizen U.S. national under federal law).

Employment is contingent on background / security investigation results.

Benefits At-a-glance

The SAA provides a highly competitive benefits package for all SAA staff. Our benefits extend beyond health care coverage to help provide employees with student loan reimbursement, professional development, transportation subsidy, TSP/retirement savings, access to our Employee Assistance Program, and more! For more information regarding SAA’s benefits, please visit .

ACCOMMODATIONS

As an Equal Opportunity Employer, the SAA is committed to providing reasonable accommodations to applicants with disabilities. If you are interested in applying for employment with SAA and need special assistance or an accommodation to complete the application process, please submit your request to with “Accommodation” in the subject line.