Tier 3 Cyber Threat Intelligence Analyst

About the role

Leidos is seeking a Tier 3 Cyber Threat Intelligence Analyst for a highly visible cyber security single-award IDIQ vehicle supporting Network Operations Security Operations (NOSC) services. The program monitors, detects, analyzes, mitigates and responds to cyber threats against the Department of Homeland Security (DHS) enterprise, and the analyst supports threat analysis, collection management and technical analysis.

Key responsibilities

• Identify, track and investigate high-priority threat campaigns and malicious actors, including their techniques, tactics and procedures (TTPs)
• Analyze and track the cyber threat landscape, including APT TTPs and activities, to strengthen the organization's cybersecurity posture
• Maintain and develop new cyber threat intelligence reports for peers, management and customers to make threat intelligence actionable
• Support the Network Operations Security Center during incident response and threat hunting, including analysis, research and remediation recommendations
• Trend and correlate intelligence sources for indicators, TTP shifts, attribution and countermeasures
• Conduct host-based and network-based forensics, malware analysis and security content development (signatures, rules)
• Correlate and enrich data from intelligence sources with internal logs, alerts and incident data from Splunk and Analyst1 to drive threat hunting and detection

Required profile

• Top Secret/SCI clearance currently held
• BS in an IT-related field with 8-12 years of IT experience, or MS with 8+ years, including at least 7 years as a Tier III senior cyber security analyst
• Two years of recent experience with host-based and network-based security monitoring solutions, including security content recommendation or development
• Strong written and oral communication skills

Required skills

• Deep understanding of the Pyramid of Pain, Cyber Kill Chain, MITRE ATT&CK and the Diamond Model
• Preferred: CASP+, CCNP-Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP, SANS GCTI, or previous DOD, IC or law enforcement intelligence training
• Preferred: scripting in Python, Bash, Visual Basic or PowerShell; familiarity with CrowdStrike Falcon, Tanium, Proofpoint TAP and Zscaler