Cyber Threat Analyst

Leidos is seeking an experienced Cyber Threat Analyst to join our Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, HI.

In this high-impact intelligence and analysis role, you will synthesize multi-source intelligence, telemetry, and forensic data into actionable threat intelligence. You will analyze adversary tactics, techniques, and procedures (TTPs), formulate threat indicators, track advanced adversary campaigns, and direct threat-informed defense operations across perimeter boundaries, multi-cloud platforms, and classified networks,spanning Unclassified (NIPRNet) and Secret (SIPRNet) up to Top Secret/SCI.

Responsibilities

1. Boundary Threat Analysis & Adversary Characterization

• Analyze boundary sensor feeds, Netflow, and IDS/IPS logs in conjunction with intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
• Apply the MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify "Living off the Land" (LotL) tradecraft, and assess the operational impact of targeted threats traversing enterprise Internet Access Points and Boundary Cloud Access Points.
• Author, refine, and disseminate high-impact, actionable battlefield cyber threat analysis products, Threat Warnings, and Tippers that empower tactical defenders and boundary engineers to preempt emerging cyber assaults.
• Evaluate bypasses and telemetry from automated blocking platforms to uncover adversary evasion techniques, evaluate malicious patterns, and generate targeted analytic hypotheses.
• Coordinate closely with the DISA Joint Operations Center (DJOC), USPACOM J6, DoD Cyber Defense Command (DCDC), USCYBERCOM, and the National Security Agency (NSA) to synchronize threat analyses and maintain standardized incident reporting in the DoD-mandated reporting structure (currently Rally).

2. Enterprise CSSP Intelligence & Proactive Threat Hunting

• Formulate threat hypotheses based on all-source intelligence, reconstruct multi-stage adversary attack paths, and conduct structured threat-hunting across enterprise endpoints and cloud enclaves to validate malicious presence or confirm its absence.
• Track advanced persistent threats operating against enterprise cloud ecosystems (AWS GovCloud, Azure Government, Google Cloud Platform, Oracle Cloud Infrastructure) secured under the Joint Warfighter Cloud Capability, Thunderdome Zero Trust Network Access (ZTNA), and Microsoft Defender suite (EndGuard).
• Translate threat intelligence and adversary TTPs into specific detection use cases, rule logic, and detection requirements for ingestion into enterprise SIEMs (Splunk, Microsoft Sentinel, Elastic, and JCRS-D).
• Aggregate threat indicators, malware behaviors, and adversary profiles from commercial threat feeds (e.g., CrowdStrike, VirusTotal) and internal investigations; provide inputs for the quarterly Aggregated Cyber Awareness Report detailing strategic threat forecasts and vulnerability exposures.
• Continuously assess Information Assurance Vulnerability Management notices (IAVAs and IAVBs) against active adversary exploitation trends, providing technical threat context and impact assessments to mission partner enclaves.

3. Location-Specific & Above-Secret Intelligence: PACOM & TS/SCI

• Provide dedicated cyber threat intelligence and behavioral profiling tailored to the PMN and JOE-CE operational networks.
• Analyze Identity, Credential, and Access Management telemetry and the PMN Master User Record to identify anomalous user behavior, insider threats, and sophisticated lateral movement.
• Conduct all-source cyber analysis within Sensitive Compartmented Information Facilities (SCIF) at Ford Island, examining multi-discipline intelligence across JWICS, YLAN, and special-access enclaves up to Top Secret / SCI.
• Brief Senior Executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary threat capabilities, active campaigns, and strategic risk postures.

Requirements

• Citizenship: Must be a U.S. Citizen.
• Clearance: Active Top Secret security clearance with eligibility to obtain SCI access upon start (adjudicated Tier 5 / SSBI investigation within scope).
• Education: Bachelor’s degree with 4+ years of relevant experience; OR an Associate degree with 6+ years; OR 8+ years of relevant experience / military service in lieu of a degree.
• Required DoD 8140 / 8570 Baseline Qualifications: Must hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent (Intermediate proficiency level) prior to start date.
• Core Technical Competencies: In-depth understanding of adversary tactics, techniques, and procedures, threat actor attribution, and mapping adversary activity to the MITRE ATT&CK framework.

Benefits

• Crucial Theater Mission: Directly defend warfighters and theater infrastructure across the most critical Indo-Pacific operational environment.
• Advanced Cyber Ecosystem: Work at the confluence of enterprise-scale SIEM environments, Zero Trust architecture, and next-generation multi-cloud platforms.
• Long-Term Program Stability: Backed by Leidos’s prime contract award on the GSM-O II Task Order 22 vehicle spanning a base year plus four option periods.
• Professional Growth & Certification Sponsorship: Extensive tuition assistance, Leidos internal training academies, and corporate sponsorship for advanced SANS/GIAC technical cyber certifications.

Pay Range: $87,100.00 - $157,450.00