Insider Threat Program Hunt Analyst

Leidos • Springfield, VA

1d • $87,100 - $157,450

About The Position

Leidos Digital Sector is hiring a Hunt Analyst to support the HEITS Contract and the Department of Homeland Security Insider Threat Program (ITP). The role supports, sustains, designs, and evolves the ITP database backbone. The program uses advanced analytics, monitoring, and data correlation to identify insider threats and help prevent potential threat actors from compromising DHS’s homeland-security mission.

The analyst examines insider-threat data, conducts proactive hunting across the DHS enterprise, and uses User Activity Monitoring (UAM) and User and Entity Behavior Analytics (UEBA) capabilities to identify suspicious patterns, anomalous activity, and policy violations. The position also supports operation of UAM/UEBA tools, coordinates responses to emerging requirements and alerts, conducts research into concerning behavior, and develops mitigation strategies for investigative teams. Critical and high UAM alerts require a response within four hours during normal business hours.

Requirements

• Bachelor’s degree and 4–8 years of prior relevant insider-threat or other relevant experience; additional years of experience with requisite certifications may be considered in lieu of a degree.
• At least 4 years of demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
• At least 4 years of demonstrated knowledge of threat assessment and mitigation strategies.
• Excellent written and verbal communication skills, including the ability to deliver briefings to diverse audiences.
• Knowledge of current domestic and international threats to U.S. national security interests.
• Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
• Self-starter capable of working independently to promote program goals.
• Working knowledge of User Activity Monitoring software and solutions.
• Working knowledge of cybersecurity toolsets designed to support ITP mission activities.
• Working knowledge of open-source toolsets.
• Working knowledge of Insider Threat Frameworks, including Pathway to Violence and Critical Pathway.
• Current TS/SCI clearance and U.S. citizenship.
• Ability to obtain DHS EOD SCI and willingness to undergo a CI polygraph.

Nice To Haves

• Master’s degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or a related field.
• At least 4 years of experience in intelligence analysis.
• Experience with User Activity Monitoring products and platforms.
• At least 4 years of experience in threat assessment and mitigation.
• Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F).
• Certified Counter-Insider Threat Professional - Analysis (CCITP-A).
• Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
• Completion of the Workplace Assessment of Violence Risk (WAVR-21) Workshop.
• Completion of CDSE curriculums INT311.CU, INT312.CU, and CI201.CU.

Responsibilities

• Examine, analyze, and search insider-threat data to identify trends, patterns, and insights into potential insider-threat indicators.
• Provide analytical and program support services related to operation of UAM/UEBA tools.
• Monitor the UAM platform for emerging requirements related to insider-threat events and coordinate across the enterprise to ensure a timely response.
• Research the UAM platform to identify patterns of concerning behavior related to potential insider-threat risk to the DHS enterprise.
• Conduct proactive insider-threat hunting across the DHS enterprise network using methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
• Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider-threat behavior.
• Identify mitigation strategies to help the investigative team reduce insider-threat risk.
• Use UEBA platforms and techniques to baseline user activity and detect deviations.
• Respond to critical/high UAM alerts within four hours during normal business hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level