Description
Leidos is seeking a Tier 3 Cyber Threat Intelligence Analyst to join their team on a highly visible cyber security single-award IDIQ vehicle. The successful candidate will provide support to the Department of Homeland Security (DHS), NOSC Support Services, which is responsible for monitoring, detecting, analyzing, mitigating, and responding to cyber threats and adversarial activity on the DHS Enterprise.
The Cyber Threat Intel Analyst will need a strong cyber security background with experience in identifying, tracking, and investigating high-priority threat campaigns, malicious actors with the interest, capability, and TTPs (Techniques, Tactics, and Procedures).
Key responsibilities include:
- Analyzing and tracking the cyber threat landscape, including identifying and analyzing cyber threats actors, APT TTPs, and/or activities to enhance cybersecurity posture of the organization's IT operating environment
- Maintaining and driving the development of new reports of Cyber Threat Intelligence analysis to peers, management, and customer teams for purposes of situational awareness and making threat intelligence actionable
- Providing support to the Network Operations Security Center during incident response and threat hunting activities that include cyber threat analysis support, research, recommending relevant remediation and mitigation
- Conducting trending and correlation of various cyber intelligence sources for the purposes of indicator collection, shifts in TTPs, attribution, and establishing countermeasures to increase cyber resiliency
- Host-based and network-based forensics related to the identification of advanced cyber threat activities, intrusion detection, incident response, malware analysis, and security content development
- Deep understanding of the cyber "Pyramid of Pain", Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model
- Ability to correlate and enrich data from intelligence sources with internal logs, alerts, and incident data from Splunk and Analyst1 to drive threat hunting and detection initiatives
- Strong written and oral communication skills
Basic qualifications:
- Currently possess a Top Secret/SCI Clearance
- BS in IT-related field and 8-12 years' experience in an IT field, or MS in IT-related field and 8+ years' experience in an IT Field, with a minimum of 7 years of experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis
- Two years of recent experience with host-based and network-based security monitoring solutions and security content recommendation or development
Preferred qualifications:
- At least one of the following certifications: CASP+, CE, CCNP-Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP
- Previous DOD, IC, or Law Enforcement Intelligence or Counterintelligence Training/Experience
- Knowledge of Structured Analytic Technique
- Developing scripts to support cyber threat detection that outputs results in a variety of formats
- Proficient in one or more of the following computer languages: Python, Bash, Visual Basic, or PowerShell
- Working familiarity with additional tools such as CrowdStrike Falcon, Tanium, Proofpoint TAP, and Zscaler