Cyber Threat Analyst

Leidos•Pearl City, HI

1d•$87,100 - $157,450•Onsite

About The Position

Leidos is seeking an experienced Cyber Threat Analyst to join its Defensive Cyber Operations team supporting Defense Information Systems Agency Pacific at Ford Island, Joint Base Pearl Harbor-Hickam, Hawaii. The role supports the GSM-O II Task Order 22 Boundary Cyber Defense and Cybersecurity Services Provider mission to defend the Department of Defense Information Network, U.S. Pacific Command, and mission partner enclaves from advanced persistent threats and nation-state cyber actors. The analyst synthesizes intelligence, network telemetry, and forensic data into actionable threat intelligence; analyzes adversary tactics, techniques, and procedures; develops threat indicators; tracks campaigns; and supports threat-informed defense operations across boundary networks, multi-cloud platforms, and classified environments. The work spans unclassified and Secret networks through Top Secret/SCI and includes SCIF-based analysis at Ford Island. The position requires U.S. citizenship and an active Top Secret clearance with eligibility to obtain SCI access upon start. Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval. The role requires a qualifying DoD 8140.03/DCWF Work Role Code 531 certification or equivalent at the Intermediate proficiency level before the start date. Standard operational shifts are expected, with occasional surge or after-hours support during critical incidents or crisis contingencies.

Requirements

Must be a U.S. citizen.
Active Top Secret security clearance with eligibility to obtain SCI access upon start, with an adjudicated Tier 5/SSBI investigation within scope. Candidates with an active Secret clearance may be considered if Top Secret/SCI processing begins immediately upon hire with government approval.
Bachelor’s degree and 4+ years of relevant experience, or an Associate degree and 6+ years of relevant experience, or 8+ years of relevant experience or military service in lieu of a degree.
Before the start date, hold a valid certification or degree compliant with DoD 8140.03/DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent at the Intermediate proficiency level.
Accepted certifications include CompTIA CySA+, GCTI, CEH, CFR, GCIA, GCIH, CND, CISSP, CASP+ CE, or GCFA.
Willingness to obtain and maintain privileged system access credentials as required by mission requirements.
In-depth understanding of adversary TTPs, threat actor attribution, and mapping activity to MITRE ATT&CK.
Experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.
Ability to analyze packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct adversary intrusions.
Hands-on familiarity querying SIEM platforms, including Splunk SPL, Elastic/Kibana, and Microsoft Sentinel KQL.
Working knowledge of threat intelligence platforms and tools such as MISP, ThreatConnect, Anomali, VirusTotal, and Shodan.
Willingness and ability to work standard operational shifts and provide occasional surge or after-hours support during critical incidents or crisis contingencies.

Nice To Haves

Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units such as 10th Fleet, 16th Air Force, or ARCYBER.
Experience conducting structured threat hunting (DCI/DD) across cloud and enterprise on-premises networks.
Knowledge of malware triage and dynamic/static analysis concepts, including sandboxing, de-obfuscation, hashing, and C2 extraction.
Familiarity with AI prompting using Gemini, Grok, or ChatGPT for automation and OSINT data collection.
Direct experience with DoD incident response frameworks, including CJCSM 6510.01F and DoDI 8530.01, and reporting platforms such as Rally and DISS.

Responsibilities

Analyze boundary sensor feeds, Netflow, and IDS/IPS logs alongside intelligence agencies, peer CSSPs, and commercial intelligence providers to support Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.
Use MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify Living off the Land tradecraft, and assess threats traversing enterprise Internet Access Points and Boundary Cloud Access Points.
Author, refine, and disseminate actionable cyber threat analysis products, Threat Warnings, and Tippers for tactical defenders and boundary engineers.
Evaluate bypasses and telemetry from automated blocking platforms to identify evasion techniques and malicious patterns and develop analytic hypotheses.
Coordinate threat analysis and standardized incident reporting with the DISA Joint Operations Center, USPACOM J6, DoD Cyber Defense Command, USCYBERCOM, and NSA.
Develop threat hypotheses from all-source intelligence, reconstruct adversary attack paths, and conduct structured threat hunting across enterprise endpoints and cloud enclaves.
Track threats targeting enterprise cloud ecosystems, including AWS GovCloud, Azure Government, Google Cloud Platform, and Oracle Cloud Infrastructure, and environments using Joint Warfighter Cloud Capability, Thunderdome ZTNA, and Microsoft Defender.
Translate threat intelligence and adversary TTPs into detection use cases, rule logic, and requirements for enterprise SIEM platforms.
Aggregate threat indicators, malware behaviors, and adversary profiles from commercial feeds and internal investigations, and contribute to the quarterly Aggregated Cyber Awareness Report.
Assess IAVAs and IAVBs against active adversary exploitation trends and provide threat context and impact assessments to mission partner enclaves.
Provide threat intelligence and behavioral profiling for the PACOM Mission Network and Joint Operational Edge – Coalition Environment.
Analyze identity, credential, and access-management telemetry and the PMN Master User Record to identify anomalous behavior, insider threats, and lateral movement.
Conduct all-source cyber analysis in Ford Island SCIFs using intelligence from JWICS, YLAN, and special-access enclaves up to Top Secret/SCI.
Brief senior executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary capabilities, campaigns, and strategic risk.