Insider Threat Program Hunt Analyst

Leidos • Springfield, VA

5d

About The Position

The Digital Sector at Leidos is hiring a Hunt Analyst to support the HEITS Contract and the Department of Homeland Security (DHS) Insider Threat Program (ITP). The role supports, sustains, designs, and evolves the ITP database backbone. The ITP uses advanced analytics, monitoring, and data correlation to identify insider threats and help prevent potential threat actors from compromising DHS’s homeland-security mission.

The analyst examines insider-threat data, conducts proactive hunts across the DHS enterprise, and uses UAM/UEBA platforms, behavioral analytics, and other cybersecurity data sources to detect, investigate, and mitigate anomalous activity and policy violations. The role provides analytical and program support for UAM/UEBA operations, coordinates responses to emerging requirements and alerts, and develops mitigation strategies to reduce insider-threat risk. Timely response to critical/high UAM alerts is required within four hours during normal business hours.

Requirements

• Bachelor’s degree and 4–8 years of prior relevant insider-threat experience or relevant experience; additional years of experience with requisite certifications may be considered in lieu of a degree.
• At least 4 years of demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
• At least 4 years of demonstrated knowledge of threat assessment and mitigation strategies.
• Excellent written and verbal communication skills, including the ability to brief diverse audiences.
• Knowledge of current domestic and international threats to U.S. national security interests.
• Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
• Self-starter capable of working independently to promote program goals.
• Working knowledge of User Activity Monitoring (UAM) software and solutions.
• Working knowledge of cybersecurity toolsets designed to support ITP mission activities.
• Working knowledge of open-source toolsets.
• Working knowledge of Insider Threat Frameworks, including Pathway to Violence and Critical Pathway.
• Current TS/SCI clearance; must be a U.S. citizen.
• Ability to obtain DHS EOD SCI and willingness to undergo a CI polygraph.

Nice To Haves

• Master’s degree from an accredited college or university in Criminal Justice, Homeland Security, Cyber Security, or a related field.
• Four or more years of intelligence analysis experience.
• Experience with User Activity Monitoring products and platforms.
• Four or more years of threat assessment and mitigation experience.
• Certified Counter-Insider Threat Professional - Fundamentals (CCITP-F).
• Certified Counter-Insider Threat Professional - Analysis (CCITP-A).
• Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
• Completion of the Workplace Assessment of Violence Risk (WAVR-21) Workshop.
• Completion of CDSE curriculums INT311.CU, INT312.CU, and CI201.CU.

Responsibilities

• Examine, analyze, and search insider-threat data to identify trends, patterns, and insights into potential insider-threat indicators.
• Provide analytical and program support services related to the operation of UAM/UEBA tools.
• Monitor the UAM platform for emerging requirements related to insider-threat events and coordinate across the enterprise to ensure timely response.
• Research the UAM platform to identify patterns of concerning behavior that may indicate potential insider-threat risk to the DHS enterprise.
• Conduct proactive insider-threat hunting across the DHS enterprise network using methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations.
• Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider-threat behavior.
• Identify mitigation strategies to help the investigative team reduce insider-threat risk.
• Use UEBA platforms and techniques to baseline user activity and detect deviations.
• Respond to critical/high UAM alerts within four hours during normal business hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level