Cyber Threat Intelligence Analyst III

General Dynamics Information Technology•Washington, DC

3d•$123,250 - $166,750•Onsite

About The Position

The Cyber Threat Intelligence Analyst III produces timely, accurate threat intelligence supporting a DHS agency’s national cyber operations. The analyst fuses classified and unclassified intelligence, open-source information, law enforcement reporting, and partner reporting into products that help leaders and operators understand threat actors, their methods, and potential risks. The role works closely with watch floor, incident management, and hunt and response teams, providing threat context to active incidents and keeping leadership informed through regular and short-turn products. The position is onsite at DHS Headquarters and other agency sites in the National Capital Region. It requires an active Top Secret clearance and eligibility to obtain and maintain TS/SCI access. The role is scheduled for 40 hours per week and requires 10–25% travel. The likely salary range is $123,250–$166,750, with actual compensation dependent on experience, geographic location, and potentially contractual requirements.

Requirements

Bachelor’s degree in Intelligence Studies, Cybersecurity, Computer Science, International Relations, or a related field, or equivalent experience.
At least 5 years of experience in cyber threat intelligence analysis.
Working knowledge of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain.
Experience with threat intelligence platforms and STIX/TAXII.
Experience writing intelligence products for senior government leaders.
Experience working with classified intelligence reporting.
Active Top Secret (TS) clearance.
Eligibility to obtain and maintain TS/SCI access.
Ability to work onsite at DHS Headquarters and other agency sites in the National Capital Region.
U.S. citizenship required.

Nice To Haves

Experience at DHS, CISA, the Intelligence Community, DoD, or FBI cyber components.
Experience analyzing threats to critical infrastructure, including industrial control systems and operational technology.
Experience using Palantir or other enterprise analytics platforms for intelligence analysis.
Experience reviewing or validating AI-assisted analysis.
GCTI, CTIA, or similar certifications.
Experience applying Intelligence Community analytic and sourcing standards (ICD 203 and ICD 206).
Experience managing intelligence requirements and requests for information, including tracking whether products met the need.
Familiarity with MITRE ATT&CK for ICS.
Ability to support nights, weekends, holidays, on-call work, and work at a continuity site during emergencies.
Current DHS suitability (Entry on Duty) determination.
Experience handling information under the Traffic Light Protocol and controlled unclassified information (CUI) markings.

Responsibilities

Continuously monitor intelligence, open-source, media, law enforcement, and partner reporting.
Analyze threat actors, campaigns, and tactics, techniques, and procedures, and map them to MITRE ATT&CK.
Assess the relevance of threats to federal, state, local, tribal, territorial, and critical infrastructure partners.
Apply structured analytic techniques and clearly state confidence and sourcing.
Produce weekly and monthly intelligence updates, leadership notes, threat summaries, and rapid briefings.
Contribute threat content to alerts, advisories, and partner communications.
Follow classification review and downgrade procedures so products can be shared at the appropriate level.
Align products to the agency’s critical information requirements and essential elements of information.
Provide threat context to triage and incident management, including indicators and actor attribution where supported.
Give hunt and response teams leads drawn from intelligence reporting.
Support surge and crisis action activities during significant incidents.
Analyze threats against critical infrastructure sectors, their dependencies, and potential consequences.
Contribute to operational and strategic reporting on critical infrastructure threats and vulnerabilities.
Use and help improve threat intelligence platforms and sharing standards such as STIX and TAXII.
Review AI-generated summaries and enrichment for accuracy before release.