Insider Threat / UAM Analyst

Leidos • Alexandria, VA

24d • $87,100 - $157,450 • Onsite

About The Position

Leidos is hiring an Insider Threat/UAM (User Activity Monitoring) Analyst to serve on the DISA J-6 UAM Team at the Mark Center in Alexandria, Virginia. The analyst triages, analyzes, and assesses UAM alerts, documents findings in a case management system, and reports them to impacted parties for follow-on analysis. The team deploys, maintains, and tunes countermeasures in response to new or changing insider-threat tactics, techniques, and procedures (TTPs). The analyst also provides information to the UAM Lead to support J-6 trending and reporting requirements.

Requirements

• Must have an active Top Secret/SCI clearance.
• Bachelor's degree and at least 4 years of professional experience; additional related years of experience may be accepted in lieu of a degree.
• At least 1 year of incident response experience.
• At least 1 year of UAM or insider-threat detection experience.
• Demonstrated experience with UAM capabilities and common insider-threat TTPs.
• Demonstrated knowledge of network traffic and communications, including known ports and services.
• Demonstrated experience coordinating with external organizations, especially Law Enforcement and Counter Intelligence.
• Knowledge of incident-handling procedures.

Nice To Haves

• Understanding of current core cybersecurity technologies and emerging capabilities.
• Understanding of the lifecycle of cybersecurity threats, attacks, attack vectors, and exploitation methods, including intrusion-set TTPs.
• Knowledge of computer security principles and DoD security protocols.
• Strong written and verbal communication skills, motivation, and the ability to create complex technical reports on analytic findings.
• Experience with Windows and other operating systems, such as Linux or Unix.
• Familiarity or experience with Intelligence Driven Defense, Cyber Kill Chain methodology, and/or the MITRE ATT&CK framework.
• Certifications that satisfy DoD-8570 IAT Level II.

Responsibilities

• Triage and analyze UAM alerts.
• Document and report findings to impacted organizations.
• Provide information to the UAM Lead for customer trending and reporting.
• Create and implement countermeasures for specific weaknesses related to known adversarial TTPs.
• Support meetings where UAM representation is needed.
• Recommend ways to improve the UAM program to contractor and government leadership.

What This Job Offers

• Job Type: Full-time