Insider Threat Program Hunt Analyst

Leidos • Springfield, VA

6d • $87,100 - $157,450

About The Position

Leidos is hiring a Hunt Analyst in its Digital Sector to support the HEITS Contract and the Department of Homeland Security (DHS) Insider Threat Program (ITP). The role supports, sustains, designs, and evolves the ITP database backbone. The program uses advanced analytics, monitoring, and data correlation to identify insider threats and help prevent potential threat actors from compromising the DHS homeland-security mission.

The analyst examines insider-threat data, performs proactive and continuous hunting across enterprise data and log sources, DHS platforms, endpoint detection and response (EDR) tools, and network traffic, and uses behavioral analytics to investigate anomalous activity and policy violations. The position also supports and monitors User Activity Monitoring (UAM) and User and Entity Behavior Analytics (UEBA) platforms, identifies emerging requirements and concerning behavior, coordinates timely responses, and recommends mitigation strategies to reduce insider-threat risk. Critical and high-priority UAM alerts require a response within four hours during normal business hours.

Requirements

• Bachelor’s degree and 4–8 years of prior relevant insider-threat experience or other relevant experience; additional years of experience with requisite certifications may be considered in lieu of a degree.
• At least four years of demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
• At least four years of demonstrated knowledge of threat assessment and mitigation strategies.
• Excellent written and verbal communication skills, including the ability to deliver briefings to diverse audiences.
• Knowledge of current domestic and international threats to U.S. national security interests.
• Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
• Ability to work independently and promote program goals as a self-starter.
• Working knowledge of User Activity Monitoring software and solutions.
• Working knowledge of cybersecurity toolsets designed to support Insider Threat Program mission activities.
• Working knowledge of open-source toolsets.
• Working knowledge of insider-threat frameworks, including Pathway to Violence and Critical Pathway.
• Current TS/SCI clearance and U.S. citizenship.
• Ability to obtain DHS EOD SCI and willingness to undergo a CI polygraph.

Nice To Haves

• Master’s degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or a related field.
• At least four years of experience in intelligence analysis.
• Experience with User Activity Monitoring products and platforms.
• At least four years of experience in threat assessment and mitigation.
• Certified Counter-Insider Threat Professional – Fundamentals (CCITP-F).
• Certified Counter-Insider Threat Professional – Analysis (CCITP-A).
• Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
• Completion of the Workplace Assessment of Violence Risk (WAVR-21) Workshop.
• Completion of CDSE curriculums INT311.CU, INT312.CU, and CI201.CU.

Responsibilities

• Examine, analyze, and search insider-threat data to identify trends, patterns, and insights into potential insider-threat indicators.
• Provide analytical and program support for the operation of UAM/UEBA tools.
• Monitor the UAM platform for emerging requirements related to insider-threat events and coordinate across the enterprise to ensure a timely response.
• Research activity on the UAM platform to identify patterns of concerning behavior related to potential insider-threat risk to the DHS enterprise.
• Conduct proactive insider-threat hunting across the DHS enterprise network, using methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
• Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider-threat behavior.
• Identify mitigation strategies to help the investigative team reduce insider-threat risk.
• Use UEBA platforms and techniques to baseline user activity and detect deviations.
• Respond to critical and high-priority UAM alerts within four hours during normal business hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level