Cyber Intelligence Fusion Analyst

Leidos•Alexandria, VA

22h•$107,900 - $195,050•Onsite

About The Position

The Cyber Intelligence Fusion Analyst supports the J361 Security Operations Center (SOC) Fusion mission on the DISA GSM-O II TN24 Penetration Handling, Incident, System Health (PHISH) Support Services II program. The position is based at the Mark Center in Alexandria, Virginia, and works 100% onsite during normal business hours, Monday through Friday, 0600–1800. The analyst is the SOC's proactive analysis and threat-hunting engine, synthesizing all-source threat reporting to conduct structured hunts, proactive environment sweeps, and tailored analytical reporting and briefings for senior leadership. The role combines cyber operations, threat intelligence, and analytic tradecraft to identify, characterize, and mitigate threats affecting tenants and subscribers throughout the National Capital Region. It correlates external intelligence with enterprise telemetry, maps adversary tactics, techniques, and procedures (TTPs), recommends detections and countermeasures, and provides threat context during investigations across classified, unclassified, and cloud environments.

Requirements

Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline and 8+ years of relevant experience; additional relevant experience, cybersecurity education, or industry certifications may substitute for a degree.
At least 4 years of experience in cybersecurity operations, cyber threat intelligence, threat hunting, incident response, cyber network defense, or a closely related cyber mission.
Active Top Secret security clearance and U.S. citizenship.
Meet DoD 8140 IAT Level II baseline certification requirements before starting work and possess, or obtain and maintain within the required program timeframe, a DoD 8140 CSSP Analyst (CSSP-A) certification.
Demonstrated experience applying MITRE ATT&CK, Cyber Kill Chain, or comparable frameworks to characterize adversary activity, TTPs, attack lifecycles, vulnerabilities, malware behaviors, and indicators.
Hands-on experience conducting end-to-end, hypothesis-driven threat hunts, including developing detection logic and queries; pivoting from external reporting, IOCs, and OSINT to enterprise telemetry; identifying data sources; executing and refining queries; validating findings through endpoint, identity, and network telemetry; documenting conclusions; and transitioning validated findings into detections, response actions, or follow-on collection requirements.
Experience with Windows and Linux host-based investigation artifacts, including process execution, command-line activity, persistence, authentication events, scheduled tasks or services, PowerShell or shell activity, file-system artifacts, and EDR telemetry.
Experience assessing telemetry quality and detection coverage against priority adversary techniques, including identifying collection gaps, normalization issues, blind spots, false-positive drivers, and recommendations for logging, analytic content, and hunt data sources.
Experience querying, analyzing, and correlating high-volume SIEM, EDR, endpoint, network, NetFlow, packet, log, and other host- or network-based security data.
Working knowledge of TCP/IP, common ports and protocols, network traffic flow, the OSI model, system administration, defense-in-depth, and enterprise security architecture.
Strong written, verbal, analytical, and collaboration skills; ability to produce technical and executive-level reports and briefings, work independently, manage competing priorities, and work effectively with technical and non-technical mission partners.
Proficiency developing, testing, and tuning analytic queries and detection content using at least one relevant query language or scripting tool, such as SPL, KQL, Elastic/Lucene query syntax, SQL, Python, PowerShell, or Unix/Linux command-line utilities.
Ability to work 100% onsite at the Mark Center during normal business hours; schedule flexibility may be required to support mission requirements.

Nice To Haves

Eligibility for TS/SCI access, including reciprocal acceptance.
Advanced cybersecurity certifications, such as CISSP, CASP+, CySA+, CEH, GIAC GCIH, GCIA, GCED, GCTI, or comparable credentials.
Experience supporting DISA, Department of Defense networks, Cyber Security Service Provider operations, Cyber Protection Teams, or a large enterprise SOC.
Experience conducting threat hunting and cyber investigations across NIPRNet, SIPRNet, JWICS, cloud, commercial, or similarly complex enterprise environments.
Experience producing intelligence products, operational reports, and executive briefings for senior executives, General Officer/Flag Officer, Senior Executive Service, or equivalent leadership; ability to lead complex cyber investigations or threat hunts and mentor junior technical staff.
Experience using SIEM, EDR, threat-intelligence, and network-analysis tools such as Splunk, Elastic, Microsoft Defender for Endpoint, Microsoft Sentinel, Google Threat Intelligence, VirusTotal, Wireshark, PCAP, and NetFlow to develop or tune correlation searches, detection rules, signatures, threat blocks, analytic queries, dashboards, and automated enrichment workflows.
Experience developing, validating, and maintaining detection content in portable or platform-specific formats, such as Sigma rules, YARA rules, Suricata/Snort signatures, SIEM correlation searches, EDR custom detections, and behavioral analytics.
Working knowledge of commercial threat-intelligence platforms, malware behavior analysis, digital and network forensic triage, endpoint telemetry, intrusion detection, vulnerability research, cloud security, and intelligence-driven defense methodologies.
Experience conducting cloud and identity-focused threat hunting using identity, authentication, audit, and workload telemetry from Microsoft 365, Microsoft Entra ID, Azure, AWS, GCP, or comparable enterprise cloud environments.
Experience performing endpoint and network forensic triage to validate hunt findings, including review of process trees, memory or disk artifacts, Windows Event Logs, Sysmon, authentication logs, DNS, proxy, firewall, PCAP, and NetFlow data.
Experience analyzing identity-based and lateral-movement behaviors, including suspicious authentication patterns, privileged-account use, remote execution, credential access, Active Directory enumeration, and persistence techniques.
Experience with adversary emulation, purple-team exercises, or detection-validation activities that map simulated adversary behavior to MITRE ATT&CK techniques and measure detection coverage, analytic fidelity, and response readiness.
Experience automating repetitive hunt, enrichment, and detection-engineering tasks through APIs, Python, PowerShell, SOAR playbooks, or case-management workflows.
Experience operationalizing threat intelligence through indicator lifecycle management, including validation, expiration, prioritization, enrichment, enterprise sweeping, and conversion of relevant intelligence into behavioral detections.

Responsibilities

Ingest, analyze, and synthesize cyber threat reporting from OSINT, government reporting, commercial threat-intelligence platforms, and other authorized sources to identify relevant threats.
Correlate external threat intelligence with SIEM, EDR, endpoint, network, PCAP, NetFlow, proxy, firewall, IDS/IPS, SSL/TLS inspection, session, and system-log telemetry to identify and assess malicious activity.
Conduct proactive IOC sweeps and hypothesis-driven threat hunts for activity associated with emerging campaigns, vulnerabilities, malware, targeted threats, and stealthy or evasive behavior.
Characterize adversary infrastructure, malware, tooling, and TTPs using MITRE ATT&CK, Cyber Kill Chain, and other applicable frameworks; assess risks to enterprise assets, tenants, and mission operations.
Develop hunt plans, adversary profiles, analytic methodologies, detection logic, and complex query strategies; coordinate and execute hunts; and document findings and recommendations in after-action reports and other mission products.
Develop, validate, and recommend countermeasures, including SIEM correlation searches, analytic content, custom signatures, and blocking recommendations; technically vet suspicious indicators before submitting detection or blocking nominations.
Produce recurring and ad hoc threat reports, intelligence assessments, executive summaries, situational-awareness updates, time-sensitive threat notifications, and strategic threat assessments.
Translate technical telemetry, forensics, intelligence reporting, and analytic findings into actionable technical, operational, and executive-level summaries; prepare and deliver briefings to leadership, tenant organizations, and mission partners.
Serve as a subject matter expert on adversary tradecraft and provide threat context, intelligence support, and analytic recommendations to incident responders and other SOC teams during investigations.
Develop and maintain SOPs, work instructions, hunt methodologies, analytic playbooks, detection use cases, and knowledge-management artifacts; identify capability and workflow gaps, recommend improvements, and enhance automation for enrichment, case management, reporting, dashboards, and metrics.
Measure and improve hunt and detection coverage against prioritized adversary behaviors; maintain a repeatable hunt backlog tracking hypotheses, data dependencies, findings, detection outcomes, unresolved gaps, and remediation recommendations.
Provide technical leadership on complex hunts and investigations, mentor junior analysts, and contribute to team training and professional development.