Cyber Security Fusion Analyst

Leidos•Fort Meade, MD

About The Position

The Cyber Security Fusion Analyst supports the DISA GSM-O II program and Joint Force Headquarters DODIN at Fort Meade. GSM-O II provides network operations and cyber defense support to the Defense Information Systems Agency in support of the Department of Defense and Combatant Commands. The analyst supports incident handling, event triage, network analysis, threat detection, trend analysis, metric development, and vulnerability information dissemination. The role uses network monitoring and detection capabilities—including netflow, custom application protocol logging, signature-based intrusion detection, and full packet capture—to identify cyber adversary activity. The analyst contributes to Cyber Fusion procedures and methodology, identifies enterprise threats and mitigation strategies, evaluates threat intelligence and vulnerability information, analyzes malicious actors' tactics, techniques, and procedures, and investigates potential system compromises. The position also provides risk assessments, countermeasure recommendations, metrics, trend analysis, and situational awareness.

Requirements

Active DoD TS/SCI clearance and eligibility for a polygraph.
Bachelor's degree in a related discipline and 8 years of related experience; additional experience may be accepted in lieu of a degree.
Security+ certification or another equivalent DoD 8570 Level II certification.
In-depth knowledge of network and application protocols, cyber vulnerabilities and exploitation techniques, and cyber threat/adversary methodologies.
Proficiency with analytical datasets, tools, and protocols, such as passive DNS, VirusTotal, Recorded Future, TCP/IP, OSI, WHOIS, enumeration, threat indicators, malware analysis results, Wireshark, Splunk, and ArcSight.
Experience with open-source and commercial vendor portals, services, and platforms that provide insight into identifying or combating enterprise threats or vulnerabilities.
Proficiency working with network data such as netflow, PCAP, and custom application logs.

Nice To Haves

Experience with the DISN and other DoD networks.
Skill in building extended cybersecurity analytics, including trends and dashboards.
Demonstrated experience briefing Senior Executive Service and General Officer/Flag Officer leadership.
Experience in intelligence-driven defense and/or cyber Kill Chain methodology.
IAT Level III and IAM Level II and III certifications.

Responsibilities

Use network monitoring and detection capabilities, including netflow, custom application protocol logging, signature-based IDS, and full packet capture data, to identify cyber adversary activity.
Support development of Cyber Fusion standard operating procedures, framework, and methodology based on industry best practices and Department of Defense instructions, guidance, and policy.
Identify enterprise threats and provide mitigation strategies to improve security and reduce the attack surface.
Analyze serialized threat reporting, intelligence product sharing, OSINT, and open-source vulnerability information to develop prioritized plans.
Analyze and document malicious cyber actors' tactics, techniques, and procedures, and recommend alignment to vulnerabilities and applicability to the operational environment.
Discover adversary campaigns, anomalies, and inconsistencies in sensor and system logs, SIEMs, and other data.
Identify, investigate, and rule out system compromises; provide written analytic summaries and attack life cycle visualizations.
Provide risk assessments and recommendations based on analysis of technologies, threats, intelligence, and vulnerabilities.
Recommend adjustments to enterprise or tactical countermeasures for threats impacting the DODIN.
Collect analysis metrics and trending data, identify key trends, and provide situational awareness.