Cyber Intelligence and Counterintelligence Analyst, Subject Matter Expert

MANTECH•Vandenberg AFB, CA

3d•$141,500 - $236,000•Onsite

About The Position

This position supports the 630th Cyberspace Squadron (630 CYS) in defending Western Launch and Test Range Systems (W-LTRS). You will provide advanced cyber threat intelligence, threat hunting, and mission assurance across range safety networks, telemetry, tracking infrastructure, electrical distribution, and Industrial Control System (ICS) environments. As a Cybersecurity Intel/CI Analyst SME, you will evaluate adversary activity, analyze TTPs, and produce actionable intelligence products supporting defensive cyberspace operations and launch assurance. This role focuses on authorized cyber defense and intel coordination and does not carry independent CI investigative or law enforcement authority.

Requirements

Bachelor’s degree in a Cyber, Intelligence, IT, or National Security discipline or related field of study; an additional 4 years of relevant experience might be substituted for a degree.
7+ years of relevant experience in threat intelligence, intelligence analysis, cybersecurity operations, defensive cyber operations, threat hunting, incident analysis, or a related technical field.
Experience producing and communicating technical intelligence products, including indications-and-warning reports, threat assessments, intelligence briefings, and responses to time-sensitive RFIs for operational, technical, and senior-leadership audiences.
Working knowledge of intelligence-driven defensive cyber operations, threat hunting, risk analysis, and threat intelligence workflows in OT, SCADA, ICS, or critical infrastructure environments.
Ability to meet applicable Department of War 8140.3 Cybersecurity Workforce Qualification Requirements, Intermediate Level, for the assigned labor category and work role.
Current Top Secret/Sensitive Compartmented Information (TS/SCI) clearance is required.

Nice To Haves

Experience supporting United States Space Force, Department of War, intelligence community, space-launch, range-operations, or critical-infrastructure missions.
Experience supporting cyber counterintelligence, foreign cyber-threat analysis, insider-threat analysis, or authorized counterintelligence coordination activities.
Experience supporting Mission Area IPB, intelligence requirements management, collection planning, or Joint Planning Process activities.
Familiarity with Defensive Cyber Operations–Space (DCO-S) tools Manticore and Kraken, as well as intelligence and counterintelligence collection tools and resources.
Experience supporting launch, telemetry, tracking, range safety, command-and-control, or other mission-critical environments, including cyber threat hunting, adversary emulation, threat modeling, cyber exercise support, or post-action validation activities.

Responsibilities

Conduct advanced cyber threat intelligence analysis, adversary profiling, pattern-of-life analysis, and proactive threat-hunting activities across designated mission systems, infrastructure, and operational technology environments.
Monitor and assess real-time cyber threat activity to identify, analyze, and report malicious logic, indicators of compromise, anomalous behaviors, potential foreign cyber threat indicators, active campaigns, and evolving adversary TTPs.
Develop and disseminate timely intelligence products, including indications-and-warning reports, technical threat reports, intelligence estimates, executive summaries, operational updates, and weekly leadership briefings, to inform defensive cyberspace operations and launch-mission assurance.
Collaborate with mission-planning cells, range operators, cybersecurity personnel, and authorized intelligence organizations to identify, scope, track, and close critical cyber threat-information gaps and support intelligence-sharing requirements.
Develop, track, and submit intelligence collection and production requirements using established tasking systems, cyber threat intelligence platforms, structured databases, and multi-source research workflows; research and respond to time-sensitive Requests for Information (RFIs) within required timelines.
Support quarterly Mission Area Intelligence Preparation of the Battlefield (IPB) reassessments, periodic reviews of intelligence products and databases, and related activities aligned with the Joint Planning Process and operational mission requirements.
Apply technical knowledge of Supervisory Control and Data Acquisition (SCADA), industrial control systems, operational technology, cyber operations, and mission-support infrastructure to assess threats, vulnerabilities, mission risks, and potential impacts to W-LTRS.
Support cyber threat-emulation activities, representative security exercises, and post-action validation efforts; document intelligence findings, defensive gaps, lessons learned and recommended cyber-hardening actions.