Insider Threat Program Hunt Analyst

Leidos • Springfield, VA

1d

About The Position

Leidos’s Digital Sector is hiring a Hunt Analyst to support the HEITS Contract and the Department of Homeland Security (DHS) Insider Threat Program (ITP). The role supports, sustains, designs, and evolves the ITP database backbone. The program uses advanced analytics, monitoring, and data correlation to identify insider threats and help protect the DHS mission.

The analyst examines insider-threat data and performs proactive hunting across the DHS enterprise to find anomalous activity, policy violations, and behavior that may indicate malicious insider activity. The position also supports the operation of User Activity Monitoring (UAM) and User and Entity Behavior Analytics (UEBA) tools, coordinates responses to emerging requirements and alerts, and identifies mitigation strategies for investigative teams. Timely response to critical and high-priority UAM alerts is required within four hours during normal business hours.

The position requires an active TS/SCI clearance and U.S. citizenship. The selected candidate must be able to obtain DHS EOD SCI and be willing to undergo a CI polygraph.

Requirements

• Bachelor’s degree and 4–8 years of prior relevant insider-threat or other relevant experience; additional years of experience with requisite certifications may be considered in lieu of a degree.
• At least four years of demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
• At least four years of demonstrated knowledge of threat assessment and mitigation strategies.
• Excellent written and verbal communication skills, including the ability to deliver briefings to diverse audiences.
• Knowledge of current domestic and international threats to U.S. national security interests.
• Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
• Ability to work independently and promote program goals.
• Working knowledge of User Activity Monitoring software and solutions.
• Working knowledge of cybersecurity toolsets designed to support ITP mission activities.
• Working knowledge of open-source toolsets.
• Working knowledge of insider-threat frameworks, including Pathway to Violence and Critical Pathway.
• Current TS/SCI clearance and U.S. citizenship.
• Ability to obtain DHS EOD SCI and willingness to undergo a CI polygraph.

Nice To Haves

• Master’s degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or a related field.
• Four or more years of proven experience in intelligence analysis.
• Experience with User Activity Monitoring products and platforms.
• Four or more years of proven experience in threat assessment and mitigation.
• Certified Counter-Insider Threat Professional – Fundamentals (CCITP-F).
• Certified Counter-Insider Threat Professional – Analysis (CCITP-A).
• Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
• Completion of the Workplace Assessment of Violence Risk (WAVR-21) Workshop.
• Completion of CDSE curriculums INT311.CU, INT312.CU, and CI201.CU.

Responsibilities

• Examine, analyze, and search insider-threat data to identify trends, patterns, and insights into potential insider-threat indicators.
• Provide analytical and program support related to operating UAM/UEBA tools.
• Monitor the UAM platform for emerging requirements related to insider-threat events and coordinate across the enterprise to ensure a timely response.
• Research the UAM platform to identify patterns of concerning behavior that could indicate a potential insider-threat risk to the DHS enterprise.
• Conduct proactive insider-threat hunting across the DHS enterprise network using methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations.
• Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider-threat behavior.
• Identify mitigation strategies to help the investigative team reduce insider-threat risk.
• Use UEBA platforms and techniques to baseline user activity and detect deviations.
• Respond to critical and high-priority UAM alerts within four hours during normal business hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level