# Cyber Threat Intelligence & SOAR Automation Analyst

**Company**: Leidos
**Location**: Whitehall, OH, OH
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $87,100.00 - $157,450.00
**Category**: Security
**Industry**: Technology

**Apply**: https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Whitehall-OH/Cyber-Threat-Intelligence---SOAR-Automation-Analyst_R-00194150-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/job/cyber-threat-intelligence-and-soar-automation-c1f44d70-f0f/

## Description

Leidos' Digital Sector is seeking an experienced, multidisciplinary Cyber Threat Intelligence & SOAR Automation Analyst supporting DISA Global.

In this role, you will perform hands-on threat intelligence analysis, feed curation, and indicator lifecycle management within Threat Intelligence Platforms (TIP), while directly designing, building, and deploying automations in SOAR environments.

**Primary Responsibilities**

- Hands-on Intelligence Analysis & Feed Curation: Analyze threat intelligence reporting, assess emerging threats, map adversary tactics to the MITRE ATT&CK framework, and evaluate indicators across diverse external and internal feeds.

- DISA TIP Administration & Indicator Lifecycle Management: Configure, maintain, and optimize DTIP feed ingestion pipelines (STIX/TAXII), manage IOC repositories, maintain data dictionaries, and tune indicator expiration policies.

- Automated Defensive Blocking & Sensor Integration: Implement low-regret scoring logic and automated blocklist distribution for security solutions.

- API Development & Custom Connectors: Write robust Python scripts and utilize REST APIs to interconnect DTIP, Tines, ticketing systems, and SIEM/log repositories.

- Investigation & Operational Triage Support: Support Cyber Security Watch Officers (CSWOs) with indicator validation, false-positive troubleshooting, and rapid-response containment workflows.

- SOAR Playbook Development & Execution: Design, build, test, and optimize automated incident response and threat-enrichment playbooks within Tines to streamline 24x7 SOC monitoring workflows.

- Platform Maintenance & Sustainment: Assist in sustaining and securing core automation and intelligence platforms, maintaining containerized services (Docker), applying STIG configurations, and leveraging Git for version control.

- Technical Intelligence Reporting: Produce technical intelligence briefs, indicator documentation, and triage summaries to inform ongoing defensive operations.

**Basic Qualifications**

- Clearance: Active Top Secret / Sensitive Compartmented Information (TS/SCI)

- Education & Experience: Bachelor's in Computer Science, Cybersecurity, IT, or a related discipline plus 4+ years of relevant hands-on operational experience.

- Threat Intelligence Platform (TIP) Experience: Experience working with TIP managing IOC lifecycles and configuring threat feed ingestions.

- SOAR & Playbook Development: Proven hands-on experience designing and implementing automated workflows and playbooks using SOAR platforms.

- Scripting & Tooling: Strong scripting skills in Python for API interactions and data parsing, with supplemental experience in Bash or PowerShell.

- Data Formats & Version Control: Proven ability to create, edit, and validate configuration files and schemas in JSON, YAML, and Git for code management.

- Enterprise Security Stacks: Applied technical understanding of enterprise security solutions and their integration mechanisms.

- DoD Compliance: Must possess an active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level baseline certification (e.g., Security+ CE, PenTest+, CySA+, GSEC, or GMON).

**Preferred Qualifications**

- Low-Regret Triage & IACD: Applied experience utilizing Integrated Adaptive Cyber Defense (IACD) low-regret scoring principles to automate indicator blocking with minimal mission impact.

- Cyber Intelligence Communication Standards: Practical experience parsing and structuring STIX/TAXII intelligence feeds and maintaining CTI data dictionaries.

- Adversary Analysis: Deep understanding of adversary TTPs and practical experience conducting adversary assessment via MITRE ATT&CK.

- SIEM & Big Data: Familiarity querying and integrating workflows with log management and SIEM platforms such as Splunk or Elastic (ELK).

- Zero Trust: Baseline understanding of Zero Trust Architecture (ZTA) concepts and principles.

- Additional Experience: Any experience with ThreatQ TIP and/or Tines

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- Python
- Bash
- PowerShell
- JSON
- YAML
- Git
- STIX
- TAXII
- MITRE ATT&CK
- SOAR
- Threat Intelligence Platforms
- SIEM

### Nice to have
- Integrated Adaptive Cyber Defense (IACD)
- STIX/TAXII
- Splunk
- Elastic (ELK)
- Zero Trust Architecture (ZTA)
- ThreatQ TIP
- Tines

---

Source: [Apply at leidos.wd5.myworkdayjobs.com](https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Whitehall-OH/Cyber-Threat-Intelligence---SOAR-Automation-Analyst_R-00194150-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)