Principal Cyber Intelligence Analyst
About The Position
Northrop Grumman’s Corporate Sector Chief Information & Digital Office (CIDO) is seeking a Principal Cyber Intelligence Analyst to support the CISO & Global Cybersecurity organization’s Cybersecurity Operations Center. The analyst will join a team of cyber defensive operators and help improve defensive operations through analysis, tool building, automation, and collaboration. The role calls for adaptability, creativity, commitment to mission, self-direction, and strong written and verbal communication skills. Candidates may bring experience as a high-performing SOC analyst seeking to reduce alert fatigue through automation or as a cyber systems engineer interested in cyber defense and incident response. The position involves monitoring and responding to threats across unclassified and classified networks, developing detection rules, and building and integrating tools to improve defensive cyber operations. The analyst will collaborate with technical and non-technical teams on incident response and DevSecOps in organic networks, restricted environments, and evolving mission settings. The role requires a current U.S. Government Top Secret clearance with SCI access and a recent polygraph adjudicated within the last five years. Travel is 10% of the time; relocation assistance is not available.
Requirements
- Relevant experience: 8 years with an associate degree, 5 years with a bachelor’s degree, 3 years with a master’s degree, or 1 year with a Ph.D. in a listed or related field.
- Current U.S. Government Top Secret security clearance, including SCI access, and a recent polygraph adjudicated within the last 5 years.
- Fluency in offensive cyber tactics, techniques, and procedures (TTPs).
- Strong foundation in defensive cyber operations in a team environment.
- Blue Team analytic mindset and experience with incident triage, threat hunting, and alert handling.
- Dev/Sec/Ops competency, including ability to write code, optimize SIEM queries, engineer integrations, and learn new technologies as needed.
- Creative problem-solving experience with cyber and IT systems, including Windows, Linux, networking, AWS, and Azure.
- Ability to work in flexible environments, including an office, a SCIF as required, and home when necessary.
- One or more active DOD 8570 IAT Level 2 certifications, such as Sec+, CySA+, GSEC, SSCP, CCNA Security, GICSP, or CND.
Nice To Haves
- Experience with classified operations and cross-domain solutions.
- Security Orchestration Automation & Response (SOAR) systems engineering and playbook development.
- Threat detection engineering experience, such as SIEM queries, EDR detections, network IDS/IPS rules, or Yara rules.
- One or more active DOD 8570 IAT Level 3 certifications, such as CASP+, CCNP Security, CISA, CISSP, CCSP, GCED, or GCIH.
- High-level industry and vendor certifications, academic or passion projects, or broader cyber community engagement.
Responsibilities
- Monitor, investigate, and respond to cyber threat alerts on unclassified and classified networks.
- Create and tune cyber threat detection rules across a variety of platforms.
- Conceptualize, build, and integrate tools that improve the efficacy of defensive cyber operations.
- Collaborate with cyber, technical, and non-technical teams on incident response and DevSecOps in organic networks, restricted environments, and an evolving mission landscape.
Benefits
- Flexible work arrangements
- Learning opportunities
- Exposure to a wide variety of projects and customers
- Friendly team environment
- Health insurance coverage
- Life and disability insurance
- 401(k) matching program
- Company-paid holidays
- Paid time off (PTO) for vacation and/or personal business
- Potential eligibility for overtime, shift differential, and a discretionary bonus, depending on the position
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Principal
Education Level
Associate degree
