Insider Threat / UAM Analyst

Leidos • Alexandria, VA

23d • Onsite

About The Position

Leidos is hiring an Insider Threat/UAM (User Activity Monitoring) Analyst to serve on the DISA J-6 User Activity Monitoring Team at the Mark Center in Alexandria, Virginia. The analyst triages, analyzes, and assesses alerts, then documents and reports findings through a case management system. Findings are shared with impacted parties for follow-on analysis. The team continually deploys, maintains, and tunes countermeasures in response to new or changing insider threat tactics, techniques, and procedures (TTPs). The analyst also provides information to the UAM Lead to support J-6 trending and reporting requirements.

Leidos describes its culture as focused on challenging the status quo and advancing the mission. The position’s stated pay range is $87,100 to $157,450; the company notes that this range is a general guideline and not a guarantee of compensation. Offers may consider job responsibilities, education, experience, skills, internal equity, market data, and other factors.

Requirements

• Active Top Secret/SCI clearance.
• Bachelor’s degree and at least 4 years of professional experience; additional related years of experience may be accepted in lieu of a degree.
• At least 1 year of incident response experience.
• At least 1 year of UAM or insider threat detection experience.
• Demonstrated experience with UAM capabilities and common insider threat TTPs.
• Demonstrated knowledge of network traffic and communications, including known ports and services.
• Demonstrated experience coordinating with external organizations, especially Law Enforcement and Counter Intelligence.
• Knowledge of incident handling procedures.

Nice To Haves

• Understanding of current and emerging cybersecurity technologies.
• Understanding of cybersecurity threat life cycles, attacks, attack vectors, methods of exploitation, and intrusion-set TTPs.
• Knowledge of computer security principles and DoD security protocols.
• Strong written and verbal communication skills, self-motivation, and ability to create complex technical reports on analytic findings.
• Experience with Windows and other operating systems, such as Linux or Unix.
• Familiarity or experience with Intelligence Driven Defense, Cyber Kill Chain methodology, and/or the MITRE ATT&CK framework.
• Certifications that satisfy DoD-8570 IAT Level II.

Responsibilities

• Triage and analyze UAM alerts.
• Document and report findings to impacted organizations.
• Provide information to the UAM Lead for customer trending and reporting.
• Create and implement countermeasures for specific weaknesses related to known adversarial TTPs.
• Support meetings where UAM representation is needed.
• Recommend ways to improve the UAM program to contractor and government leadership.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level