Defensive Cybersecurity Analyst

Leidos•Shiloh, IL

20d•Onsite

About The Position

We are seeking proactive defenders who bring Security Operations Center (SOC) experience, exceptional critical thinking skills, and a self-motivated approach to safeguarding infrastructure as Cyber Security Analysts in our 24x7 front-line security operations team. In this role, you will be directly responsible for defending Department of Defense (DoD) networks against sophisticated, rapidly evolving cyber threats.

Requirements

Active DoD Secret clearance, with the ability to obtain and maintain a TS/SCI.
Current DoD 8570 IAT Level II (or higher) certification, such as CompTIA Security+ CE, ISC2 SSCP, or SANS GSEC (or equivalent 8140 requirements).
Ability to obtain a DoD 8570 CSSP-Analyst level certification (e.g., CEH, CySA+, GCIA, or equivalent) within 180 days of hire.
Solid foundation in networking principles, including packet analysis, common ports/protocols, traffic flow, the OSI model, and defense-in-depth architecture.
Level I: Bachelor's degree and 2+ years of relevant experience (Equivalent professional work or military experience will be considered in lieu of a degree)
Level II: Bachelor's degree and 4+ years of relevant experience (Equivalent professional work or military experience will be considered in lieu of a degree).

Nice To Haves

Prior experience working within Defense Information Systems Agency (DISA) or DOD Environments.
Experience applying intelligence-driven defense strategies utilizing the MITRE ATT&CK or Cyber Kill Chain frameworks, including a deep understanding of intrusion set tactics, techniques, and procedures (TTPs).
In-depth experience utilizing SIEM/SOAR platforms to perform behavioral and statistical analysis across multiple log types.
Knowledge or experience in defending cloud environments (AWS, Azure, GCP) or administering enterprise mobile security (MDM, MAM, MTD).
Basic scripting and programming skills to automate routine analytical tasks.

Responsibilities

Investigate and triage security alerts generated from endpoints, IDS/IPS, NetFlow data, and custom sensors to identify suspicious activity.
Analyze extensive log files, pivot between diverse datasets, and correlate evidence to support incident investigations, producing detailed technical findings and reports.
Monitor and integrate DoD and open-source threat intelligence feeds and Indicators of Compromise (IOCs) into security sensors and SIEM platforms.
Collaborate closely with incident response teams and ensure timely, clear communication of security incidents to customers and USCYBERCOM.