Cyber Threat Analyst

Johns Hopkins Applied Physics Laboratory•Laurel, MD

About The Position

Are you interested in joining a next-level cyber defense team that operates in an inclusive and fulfilling work environment? If so, join us at APL! We are seeking a cybersecurity specialist to identify and root out sophisticated threat actors in an actively evolving threat landscape. On our Defensive Cyber Operations (DCO) team, you will contribute to incident investigations, detection development, and capability improvement in a group that fosters growth and collaboration. We strive to be considered “best-in-class” in cybersecurity, so we need analysts who are passionate about excelling in their field! This role bridges traditional defense monitoring and data analytics to identify novel attacker behaviors. Ideal candidates will combine curiosity, data fluency, and familiarity with adversary tradecraft to continuously evolve our detection and response ecosystem. As a Cyber Threat Analyst you will… Correlate log sources, device telemetry, and security tool data to hunt for APT actor activity and investigate indications of compromise. Build detection and prevention controls based on threat reporting and observed activity. Investigate incidents by identifying compromise activity through analysis of device images, artifacts, logs, and network traffic. Support efforts focused on detection, capability, and procedure refinement. Develop your skills through training, practice, and studying current cyber trends.

Requirements

Bachelor's Degree in Information Security, Computer Science, a related field, or equivalent experience that matches the required knowledge, skill and abilities.
3-5 years of real-world cyber and/or data science experience involving anomaly detection using EDRs, packet captures, malware analysis sandboxes, SIEM/SOAR toolsets, and scripting languages (e.g. Python, PowerShell, SQL).
Flexibility to work occasional evenings and weekends for on-call shifts and incident response events.
Current Secret clearance, or ability to acquire one. Eligibility requirements include U.S. citizenship.

Nice To Haves

A Master's Degree in Computer Science, Information Security Assurance, or related field.
Experience with Assume Breach methodologies and investigating sophisticated attacker tradecraft in complex environments.
Experience with statistical analysis, data science techniques, using LLMs, or using agentic systems to identify outliers and to enhance DCO capabilities.

Responsibilities

Correlate log sources, device telemetry, and security tool data to hunt for APT actor activity and investigate indications of compromise.
Build detection and prevention controls based on threat reporting and observed activity.
Investigate incidents by identifying compromise activity through analysis of device images, artifacts, logs, and network traffic.
Support efforts focused on detection, capability, and procedure refinement.
Develop your skills through training, practice, and studying current cyber trends.