Joshua Somers

WORK HISTORY

EDUCATION

ABOUT JOSHUA SOMERS

I hunt threats for a living, and I mean that literally.As a Federal Enterprise Threat Hunter at USDA, I operate at the intersection of threat intelligence, anomaly detection, and detection engineering. My day-to-day involves building detection pipelines in Splunk SPL and MDE KQL, developing hunt playbooks in PEAK/ABLE format, and running incident response workflows in federal environments where precision isn\'t optional.My approach is simple: find the problem before it finds you. I\'m less interested in dashboards that confirm everything is fine and more interested in the signal that says something isn\'t. That root-cause, problem-finder orientation is how I\'m wired, in security and everywhere else.My stack runs deep: Microsoft Defender for Endpoint, Zeek, CAPE sandbox analysis, Splunk ES, SOAR (Splunk Phantom), Tanium, and an isolated malware research lab I\'ve built for APT behavior analysis. I hold a B.S. in Computer and Information Science, an M.S. in Cybersecurity and Information Assurance, and hold various certifications with more to follow.Beyond my core role, I contribute to my parent company on federal bid submissions, HACS SIN interviews, and CMMC enclave work, bridging operational security knowledge with the contracting side of the federal space.Outside of work I build. ThreatCheck is an open-source Python CLI tool for IP reputation and threat intelligence aggregation. I\'m also developing Python-based security automation and AI-assisted tooling aimed at scaling detection capability beyond what manual analysis alone can deliver.If you\'re working on hard problems in threat detection, federal cyber, or detection engineering, I want to talk.