Tier 3 Cyber Threat Intelligence Analyst

Overview

Leidos is seeking a Tier 3 Cyber Threat Intelligence Analyst to join our team on a highly visible cyber security single-award IDIQ vehicle that provides Network Operations Security Operations (NOSC) support, cyber analysis, and application development.

Department of Homeland Security (DHS), NOSC Support Services is a US Government program responsible to monitor, detect, analyze, mitigate, and respond to cyber threats and adversarial activity on the DHS Enterprise. DHS NOSC has primary responsibility for monitoring and responding to security events and incidents detected at the Trusted Internet Connection (TIC) and Policy Enforcement Point (PEP) and is responsible for directing and coordinating detection and response activities performed by each Component SOC.

Direction and coordination are achieved through a shared DHS incident tracking system and other means of coordination and communication.

The Cyber Threat Intel Analyst will need a strong cyber security background with experience with the following:
Identify, track and investigate high priority threat campaigns, malicious actors with the interest, capability and TTPs (Techniques, Tactics and Procedures).

Bring a comprehensive understanding, analyzing and tracking the cyber threat landscape, including identifying and analyzing cyber threats actors, APT TTPs and/or activities to enhance cybersecurity posture of the organization’s IT operating environment.

• Identify, track and investigate high-priority threat campaigns and malicious actors with interest, capability, and TTPs (Techniques, Tactics and Procedures).
• Analyze and track the cyber threat landscape, including identifying and analyzing threat actors, APT TTPs and activities to enhance the organization’s IT operating environment.
• Provide support to the Network Operations Security Center during incident response and threat hunting activities, including cyber threat analysis support, research, and recommending relevant remediation and mitigation.
• Conduct trending and correlation of various cyber intelligence sources for indicator collection, shifts in TTPs, attribution, and development of countermeasures to increase cyber resiliency.
• Host-based and network-based forensics related to identification of advanced cyber threat activities, intrusion detection, incident response, malware analysis, and security content development (e.g., signatures, rules).
• Deep understanding of the cyber “Pyramid of Pain”, Cyber Kill Chain, MITRE ATT&CK and the Diamond Model. Conduct in-depth research into threat actors, tools, infrastructure, and TTPs using these frameworks.
• Correlate and enrich data from intelligence sources with internal logs, alerts, and incident data from Splunk and Analyst1 to drive threat hunting and detection initiatives.
• Maintain and drive the development of new reports of Cyber Threat Intelligence analysis to peers, management and customer teams for situational awareness and making threat intelligence actionable.
• Strong written and oral communication skills to clearly convey findings and recommendations.

• The candidate must currently possess a Top Secret/SCI Clearance.
• BS in IT-related field and 8-12 years’ experience in an IT field, or MS in IT-related field and 8+ years’ experience in an IT field, with a minimum of 7 years of experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis.
• Two years of recent experience with host-based and network-based security monitoring solutions, including security content recommendation or development (host-based and network signatures).
• Ability to develop and maintain new Cyber Threat Intelligence reports for situational awareness and actionable threat intelligence.
• Proven ability to support incident response and threat hunting activities within a NOSC framework.
• Experience with trending and correlation of cyber intelligence data to inform countermeasures.
• Experience with host-based and network forensics related to advanced cyber threat activities, intrusion detection, incident response, malware analysis, and security content development.
• Knowledge of…