Cyber Security Fusion Analyst

Leidos•Odenton, MD

1d•$87,100 - $157,450

About The Position

The Leidos Digital Modernization Sector is hiring a Cyber Security Fusion Analyst for the DISA GSM-O II program, supporting the Department of War Defense Cyber Command (DCDC) at Fort Meade. GSM-O II provides network operations and cyber defense support to the Defense Information Systems Agency in support of the Department of War and Combatant Commands. The analyst supports incident handling, event triage, network analysis, threat detection, trend analysis, metric development, and vulnerability information dissemination.

Requirements

Active Department of War TS/SCI clearance and eligibility for a polygraph.
Bachelor's degree in a related discipline and four years of related experience; additional experience may be accepted in lieu of a degree.
Security+ certification or another equivalent Department of War 8570 Level II certification.
In-depth knowledge of network and application protocols, cyber vulnerabilities and exploitation techniques, and cyber threat and adversary methodologies.
Proficiency with analytical datasets, tools, and protocols, such as passive DNS, VirusTotal, Recorded Future, TCP/IP, OSI, WHOIS, enumeration, threat indicators, malware analysis results, Wireshark, Splunk, and ArcSight.
Experience with open-source and commercial vendor portals, services, and platforms that provide insight into identifying or combating enterprise threats and vulnerabilities.
Proficiency working with network data such as NetFlow, PCAP, and custom application logs.

Nice To Haves

Experience with DISN and other Department of War networks.
Skill in building extended cybersecurity analytics, including trends and dashboards.
Demonstrated experience briefing Senior Executive Service and General Officer/Flag Officer leadership.
Experience in intelligence-driven defense and/or Cyber Kill Chain methodology.
IAT Level III and IAM Level II and III certifications.

Responsibilities

Use network monitoring and detection capabilities, including NetFlow, custom application protocol logging, signature-based IDS, and full packet capture data, to identify cyber adversary activity.
Support development of Cyber Fusion standard operating procedures and the Cyber Fusion Framework and Methodology, drawing on industry best practices and Department of War instructions, guidance, and policy.
Identify enterprise threats and recommend mitigation strategies to improve security and reduce the attack surface.
Analyze serialized threat reporting, intelligence product sharing, OSINT, and open-source vulnerability information to develop prioritized plans.
Analyze and document malicious cyber actors' tactics, techniques, and procedures, and recommend alignment to vulnerabilities and applicability to the enterprise operational environment.
Discover adversary campaigns, anomalies, and inconsistencies in sensor and system logs, SIEMs, and other data.
Identify, investigate, and rule out system compromises; produce written analytic summaries and attack life-cycle visualizations.
Provide risk assessments and recommendations based on analysis of technologies, threats, intelligence, and vulnerabilities.
Recommend adjustments to enterprise or tactical countermeasures for threats affecting the DOWIN.
Collect analysis metrics and trending data, identify key trends, and provide situational awareness.