Cyber Threat Analyst

General Dynamics Information Technology•USA VA Home Office (VAHOME), VA

1d•$96,569 - $130,651•Remote

About The Position

GDIT is seeking a Cyber Threat Analyst to support the United States Postal Service (USPS) Chief Information Security Officer (CISO) Operations organization and its Detection and Automation Engineering (DAE) program. The analyst will design, implement, and maintain automated and Super Intelligence–enabled security detection and integration capabilities across enterprise security-monitoring technologies. The role strengthens threat detection and response through detection engineering, security automation, systems integration, data analysis, Super Intelligence, and continuous improvement of detection content and workflows. The analyst will work closely with security operations, threat intelligence, and incident response stakeholders, and will document and operationalize security capabilities, processes, and workflows. The position is remote, with additional work locations listed in Morrisville, North Carolina; Falls Church, Virginia; and Eagan, Minnesota. It is scheduled for 40 hours per week, with less than 10% travel required. The likely salary range is $96,569–$130,651, with compensation determined by experience, geographic location, and possibly contractual requirements. The selected candidate must be able to obtain and maintain a Public Trust clearance and pass a government background screening. The role has a U.S. residency requirement covering the preceding five years, with specific limits on consecutive time spent outside the U.S. during the last three years.

Requirements

At least 8 years of relevant experience.
Bachelor’s degree in engineering or another IT/security-related major, or equivalent experience. If the candidate does not have a relevant college degree, an additional 4 years of relevant work experience is required.
Knowledge of detection engineering and automation/Super Intelligence.
Expertise integrating security platforms.
Requirements analysis skills.
Experience testing and validating security detections and workflows.
Security data analysis experience.
Documentation and sustainment experience.
Cross-functional coordination experience.
Experience researching and evaluating emerging capabilities.
Knowledge of SOAR tools, including SentinelOne, SentinelOne Hyper Automation, Splunk Enterprise Security, and Splunk SOAR.
Knowledge of Super Intelligence security, SOC operations and processes, the threat intelligence lifecycle and analysis, and incident response methodologies.
Knowledge of network protocols and architecture; Windows, Linux, and Unix operating systems; AWS, Azure, or GCP cloud platforms; and security architecture and design.
Programming or scripting knowledge in Python, PowerShell, Bash, or similar, and API integration and development.
Knowledge of detection engineering methodologies and security automation and orchestration concepts.
Knowledge of malware analysis, digital forensics procedures, risk assessment methodologies, and machine learning and Super Intelligence for security.
Knowledge of NIST SP 800-53 security controls, CIS Controls, MITRE ATT&CK, the CISA NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB Circulars, federal cybersecurity directives, and the Privacy Act.
CompTIA Security+ or equivalent baseline certification.
One of GCIA, GCIH, or CompTIA CySA+.
Programming/scripting certification or demonstrated proficiency in Python, PowerShell, or a similar language.
Ability to obtain and maintain a Public Trust clearance and successfully pass government background screening, including detailed forms and fingerprinting.
Meet the USPS U.S. residency requirement: U.S. citizens cannot have left the U.S. (including territories) for longer than 6 consecutive months in the last 3 years unless an exception applies; non-U.S. citizens cannot have left for longer than 90 consecutive days in the last 3 years.

Nice To Haves

CISSP or GIAC Security Essentials (GSEC).
CompTIA SecAI+.
GMON or a similar continuous monitoring/detection-focused certification.

Responsibilities

Build automation and Super Intelligence (SI) workflows to improve detection and response.
Integrate and optimize security technologies into a cohesive detection architecture.
Translate operational security needs into technical specifications and implementations.
Test, evaluate, and validate detections and automation workflows.
Analyze telemetry for anomalies, trends, and detection gaps.
Recommend and implement detection enhancements.
Create and maintain documentation, standard operating procedures, and runbooks.
Coordinate with security operations center, threat intelligence, and incident response teams.
Research and assess emerging security and SI/machine learning capabilities to enhance detection.
Support the USPS CISO Detection and Automation Engineering program.
Design, implement, and maintain automated and SI-enabled detection and integration capabilities.
Strengthen threat detection and response and collaborate with operations, intelligence, and incident response stakeholders.

Benefits

Medical plan options, some with Health Savings Accounts.
Dental plan options.
Vision plan.
401(k) plan with pre-tax and post-tax contributions and a company match.
Full flex work weeks where possible.
Paid time off plans, including vacation, sick and personal time.
Paid holidays, including 10 paid holidays per year.
Typically 15 days of paid leave per calendar year for new employees, prorated based on hire date.
Paid parental leave.
Military, bereavement, and jury duty leave.
Paid Family Leave of up to 160 hours in a rolling 12-month period for eligible employees.
Short- and long-term disability benefits.
Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance.