Cyber Threat Analyst (TN19)

• Novel Playbook Authoring: Design, test, and operationalize novel threat hunting playbooks focused on behavioral anomalies, abnormal command and control (C2), lateral movement, and traffic pattern deviations across JFN transport nodes.
• Proactive Hypothesis Hunting: Formulate threat hypotheses based on all-source intelligence and observed indicators, interrogating the Elastic Search / Defend SIEM and raw network telemetry to uncover persistent, evasive adversary tradecraft.
• Routine Threat Containment: Leverage Atlassian JIRA to author, refine, and maintain standardized processes and playbooks for executing routine threat containment actions and defensive countermeasure coordination.
• MITRE ATT&CK Mapping: Map adversary tactics, techniques, and procedures (TTPs) targeting tactical fires and command-and-control networks to the MITRE ATT&CK® framework to identify visibility gaps and improve defensive posturing.
• SIEM Detection Tuning: Recommend and refine custom detection queries (Elastic KQL/EQL) and alert correlations within Elastic Defend to optimize detection accuracy and reduce false positives for the 24/7 watch cell.

• Incident Response Architecture: Drive the technical threat intelligence and containment sections of the JFN Incident Response Plan in alignment with enterprise standards.
• DIA-Aligned TS/SCI Incident Reporting: Strictly enforce Defense Intelligence Agency (DIA) requirements for TS/SCI incident handling, ensuring all spills, unauthorized access attempts, system compromises, and operational anomalies are reported through authorized channels within mandated reporting windows.
• CSSP Alignment & Briefings: Support the delivery and maturity of four of the seven DoD Cybersecurity Service Provider (CSSP) core functions during Phase I standup, providing actionable threat summaries, warnings, and intelligence briefings to JFN leadership, DISA, and mission stakeholders.

• Citizenship: Must be a U.S. Citizen.
• Security Clearance: Must possess an active Top Secret clearance with current SCI eligibility (adjudicated Tier 5 / SSBI) prior to start date, with the ability to maintain clearance while working in a secure SCIF environment.

• Level II (Intermediate): Bachelor’s degree in Cybersecurity, Intelligence Studies, Computer Science, Information Technology, or related discipline and 2+ years of direct experience in cyber threat intelligence, all-source cyber analysis, threat hunting, or SOC tier-2/tier-3 operations; OR an Associate degree and 4+ years; OR 6+ years of relevant professional/military cyber intelligence experience in lieu of a degree.
• Level III (Senior): Bachelor’s degree in a technical discipline and 4+ years of relevant experience; OR an Associate degree and 6+ years; OR 8+ years of relevant experience/military service in lieu of degree.

• Must hold a valid certification or degree meeting DoD 8140.03 / DCWF Work Role Code 531 Cyber Defense Incident Responder at the Intermediate Proficiency Level prior to hire.
• Accepted Certifications include: CySA+, GIAC GCTI, EC-C CEH or CND, Security+ CE, GIAC GSEC, or higher (e.g., CASP+ CE, CISSP, GCIA, GCIH).

• Strong experience in threat hunting, cyber threat intelligence, or advanced incident analysis within a DoD, military, or government SOC/DCO environment.
• Proven ability to analyze and correlate network protocol telemetry, Netflow, proxy logs, and raw packet captures to reconstruct complex intrusion paths.
• Hands-on proficiency querying SIEM platforms—specifically Elasticsearch, Logstash, Kibana (ELK) / Elastic Defend—using KQL or Lucene query syntax.
• Deep knowledge of adversary TTPs, threat actor attribution, and operational mapping using the MITRE ATT&CK framework.
• Direct experience writing incident documentation, standard operating procedures, and containment playbooks in JIRA.
• Ability to work standard operational shifts with readiness for on-call surge or emergency incident escalation.

• Prior experience supporting C4ISR systems or tactical operational enclaves (e.g., PMN).
• Operational experience analyzing telemetry from Corelight (Zeek), Darktrace MDR, or Palo Alto Advanced Threat Prevention (ATP).
• Experience utilizing AI prompting tools (Gemini, Grok, ChatGPT) to automate threat hunting data collection and indicator extraction.
• Career Growth & Certification Support: Access Leidos cyber training pipelines, tuition assistance, and corporate sponsorships for premier technical credentials (SANS/GIAC, cloud security).
• Long-Term Program Backing: Solidified role on a high-priority joint program supporting strategic defense requirements across DISA.

Powered by JazzHR