Target Hiring Range: $158,000–$178,000
Department: Chief Information Officer Posting Date Range: 8/3/2026-8/17/2026 Pay Grade Range: $143,516-$194,617
Work Hours: 1:45 p.m. - 10:15 p.m.
FLSA Status: Exempt
Work Location Status: Hybrid
Hybrid Schedule: 2-3 days a week onsite.
All remote or hybrid work arrangements must be performed from within the continental United States, subject to Sergeant at Arms approval.
The Senate Sergeant at Arms does not pay for relocation expenses.
This vacancy announcement closes at 11:59pm EST. Late applications will not be accepted.
Job Description
JOB OVERVIEW
The Target Hiring Range for this position is: $158,000–$178,000
About Us
The Sergeant at Arms plays a crucial role in upholding the operational integrity of the Senate community. Our vision is to foster an environment of innovation, collaboration, and adaptability, ensuring uninterrupted legislative proceedings irrespective of time, place, or circumstance. The Cybersecurity department is responsible for protecting the systems and information used to create the legislation that underwrites our democracy. We create a resilient cybersecurity operation by pro-actively identifying, protecting, detecting, reacting, and recovering (IPDRR) the US Senate enterprise. We combine people, processes, and technology into a state of the art, continuous risk-reduction practice that is flexible, innovative, and effective.
Role Overview
The Threat Hunt & Response Principal Specialist serves as a senior technical authority within the Cybersecurity Threat Hunt & Response Team, operating at the forefront of the Senate’s cyber defense mission. This is a high-tempo, always-on role demanding deep expertise across two equally critical disciplines: network forensics and threat hunting, underpinned by hands-on response leadership.
In this role, you will lead proactive, hypothesis-driven hunts across the enterprise, network traffic analysis, protocol inspection, and log forensics to surface stealthy threats before they escalate. Working closely with both offensive and defensive security teams, you will translate findings into new monitoring and detection capabilities, ensuring the Senate’s cybersecurity posture continuously improves through every engagement. When incidents occur, you will serve as the senior technical lead, driving rapid containment and root cause analysis with a strong emphasis on network-layer evidence that help strengthen the organization's overall security and readiness against future threats.
Key Responsibilities
As a Threat Hunt & Response Principal Specialist, your role is crucial in protecting our organization’s digital assets and supporting our cybersecurity initiatives. Your key responsibilities include:
- Threat Hunting – Lead proactive, hypothesis-driven threat hunts across the enterprise to identify stealthy, undetected, or emerging threats. Leverage adversary TTPs, threat intelligence, and behavioral analytics — with a particular focus on network-based evidence — to develop and execute hunting hypotheses. Document findings, refine methodologies, and translate hunt results into actionable detections and intelligence products.
- Network Forensics & Analysis – Serve as the team’s senior network forensics subject matter expert. Conduct deep-packet inspection, traffic reconstruction, and protocol analysis to uncover attacker activity, lateral movement, and data exfiltration. Leverage tools such as Zeek, Wireshark, Snort, and Suricata to analyze network telemetry and build a complete picture of adversary behavior across the enterprise.
- Incident Response – Lead and coordinate responses to complex cybersecurity incidents, including malware infections, data breaches, insider threats, and advanced persistent threats (APTs). Serve as incident commander during major security events, ensuring timely communication, effective decision-making, and cross-team coordination with SOC, threat intelligence, vulnerability management, IT operations, legal, and compliance teams. Perform in-depth forensic analysis of systems, networks, logs, and endpoint data to determine root cause, scope, and impact. Produce clear, detailed incident reports, post-incident reviews, and executive-level briefings.
- Detection Engineering – Use technical expertise and deep understanding of adversary TTPs to design, develop, and implement custom detections that address gaps in the current detection posture. Deploy and tune detections across network, host, and cloud environments, ensuring fidelity, coverage, and operational usability. Continuously refine detection logic based on hunt findings, incident learnings, and emerging threat intelligence.
- Leadership & Mentorship – Mentor and guide junior threat hunters and incident responders, elevating the team’s overall technical capability. Develop, refine, and execute threat hunt and incident response playbooks, procedures, and escalation processes. Identify gaps in detection and response capabilities and champion improvements to tools, processes, and controls.
Key Accountabilities/Essential Job Duties
Provides functional and/or technical skills for the assigned cybersecurity unit. Supports the unit’s work effort as required in preparing materials for collaborating with other sections, divisions, departments, and vendors to gather and disseminate information. Contributes to the unit’s work effort as required in preparing analysis and materials for providing expert-level support in the assigned area of cybersecurity to SAA IT security branch staff, other SAA technical staff, SAA procurement staff, and other divisions or departments, and for identifying and resolving critical and complex issues in the assigned unit. Supports the unit’s work effort as directed in providing leadership to the unit’s project teams and contractors. Work includes helping to develop plans, assignments, and coordination of work efforts. Supports the unit’s work effort to develop governing policies, standards, and procedures. Other duties as assigned.
JOB SPECIFICATIONS
Required Education
High School Diploma/GED.
Required Work Experience
- Seven to ten years of progressively responsible experience in cybersecurity, with a track record of leading initiatives to resolve highly complex cybersecurity issues. Subject matter expertise in one or more cybersecurity domains. Strong leadership skills, including experience managing project teams and coordinating efforts across multiple departments. Demonstrated ability to develop and implement strategic cybersecurity policies, standards, and frameworks that align with organizational goals.
Required Special Skills/ Knowledge
- As part of our hiring process, we may conduct a skills assessment to better understand an applicant’s proficiency in key areas relevant to the role.
Desired Qualifications
We are seeking an experienced, senior-level cybersecurity professional ready to operate at the forefront of US Senate’s cyber defense. The ideal candidate should have:
- Cybersecurity Experience: 7–10 years of progressively responsible experience in cybersecurity, with a demonstrated track record of leading initiatives to resolve highly complex cybersecurity issues. At least 5 years of that experience should be in threat hunting, network forensics, or incident response, with hands-on expertise in network-layer analysis and adversary pursuit.
- Domain Expertise: Subject matter expertise in one or more cybersecurity domains, with particular depth in network forensics, threat hunting, or digital forensics and incident response (DFIR). Experience operating in high-tempo, enterprise-scale environments is strongly preferred.
- Leadership & Collaboration: Strong leadership skills, including experience managing project teams and coordinating efforts across multiple departments. Proven ability to serve as a technical authority and mentor to junior team members while maintaining hands-on operational proficiency.
- Communication Skills: The ability to communicate complex technical findings clearly and concisely both verbally and in writing to audiences ranging from technical practitioners to executive leadership and legislative stakeholders.
- Self-Directed Learning: The ability to rapidly learn highly technical concepts with minimal instruction, stay current with the evolving threat landscape, and apply new knowledge operationally without formal training. Security Clearance: Must be able to obtain and maintain a security clearance.