Cyber Threat Analyst

VulnU; Hawaii; On-site; USD 87,000 - 157,000; Full time

Benefits offered by this job

Learning budget

Retirement match

Paid parental leave

Equity

Job summary

Leidos is seeking a Cyber Threat Analyst to join the Defensive Cyber Operations team supporting DISA PAC at Pearl Harbor, HI. You will synthesize multi-source intelligence and telemetry to produce actionable threat intelligence, track campaigns, and direct threat-informed defense across boundary points and multi-clouds.

You will work with SIEMs like Splunk, Elastic, and Microsoft Defender, coordinate with national-level centers, and operate in a TS/SCI environment on classified networks.

Qualifications

• Bachelor’s degree with 4 years of relevant experience; or 8 years of equivalent military experience.
• Must hold DoD 8140/8570 baseline qualifications and related credentials.
• Active Top Secret with SCI eligibility or ability to obtain it upon start.

Responsibilities

• Analyze boundary sensor feeds, logs, and telemetry for warnings and attacks.
• Track adversary campaigns using MITRE ATT&CK and map TTPs to defense actions.
• Author threat intelligence products, briefs, and operational Tippers.
• Reconstruct intrusions from logs and telemetry to guide defenses.
• Coordinate with DJOC, USPACOM, DCDC, NSA for standardized reporting.

Skills

Threat analysis

Boundary analysis

MITRE ATT&CK usage

SIEM query (Splunk)

Threat intelligence

Education

Bachelor’s degree with 4 years relevant experience

Tools

Splunk

Elastic/Kibana

Microsoft Sentinel

Job description

# Cyber Threat AnalystLeidos · leidos.comCategory: Security EngineeringLocation: Pearl Harbor, HISalary: $87,100 – $157,450Clearance: TS/SCI## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Learning budget* Retirement match* Paid parental leave* EquityIlluminate Emerging Adversary Campaigns Across the Pacific Cyberspace FrontierLeidos is seeking an experienced, analytical Cyber Threat Analyst to join our Defensive Cyber Operations (DCO) team supporting Defense Information Systems Agency Pacific (DISA PAC) at Ford Island, Joint Base Pearl Harbor-Hickam, HI. Operating under the Global Services Management – Operations II (GSM-O II) Task Order 22 (TN22) Boundary Cyber Defense and Cybersecurity Services Provider (CSSP) contract, our mission is to defend the Department of Defense Information Network (DODIN/DISN), U.S. Pacific Command (USPACOM), and critical mission partner enclaves against sophisticated advanced persistent threats and nation-state cyber actors.In this high-impact intelligence and analysis role, you will synthesize multi-source intelligence, telemetry, and forensic data into actionable threat intelligence. You will analyze adversary tactics, techniques, and procedures (TTPs), formulate threat indicators, track advanced adversary campaigns, and direct threat-informed defense operations across perimeter boundaries, multi-cloud platforms, and classified networks—spanning Unclassified (NIPRNet) and Secret (SIPRNet) up to Top Secret/SCI. What You’ll Do1. Boundary Threat Analysis & Adversary Characterization· Warning Intelligence & Attack Sensing: Analyze boundary sensor feeds, Netflow, and IDS/IPS logs in conjunction with intelligence agencies, peer CSSPs, and commercial intelligence providers to deliver Warning Intelligence and Attack Sensing and Warning activities compliant with DoDI 8530.01.· Adversary Campaign Tracking: Apply the MITRE ATT&CK and Cyber Kill Chain frameworks to characterize adversary behavior, track campaign evolution, identify Living off the Land (LotL) tradecraft, and assess the operational impact of targeted threats traversing enterprise Internet Access Points and Boundary Cloud Access Points.· Actionable Battlefield Intelligence: Author, refine, and disseminate high-impact, actionable battlefield cyber threat analysis products, Threat Warnings, and Tippers that empower tactical defenders and boundary engineers to preempt emerging cyber assaults.· Automated Telemetry & Breach Assessment: Evaluate bypasses and telemetry from automated blocking platforms to uncover adversary evasion techniques, evaluate malicious patterns, and generate targeted analytic hypotheses.· Operational Reporting & DJOC Synchronization: Coordinate closely with the DISA Joint Operations Center (DJOC), USPACOM J6, DoD Cyber Defense Command (DCDC), USCYBERCOM, and the National Security Agency (NSA) to synchronize threat analyses and maintain standardized incident reporting in the DoD-mandated reporting structure (currently Rally).2. Enterprise CSSP Intelligence & Proactive Threat Hunting· Deliberate Defense (DD) & Discovery Counter Infiltration (DCI): Formulate threat hypotheses based on all-source intelligence, reconstruct multi-stage adversary attack paths, and conduct structured threat-hunting across enterprise endpoints and cloud enclaves to validate malicious presence or confirm its absence.· Multi-Cloud & Zero Trust Threat Analysis: Track advanced persistent threats operating against enterprise cloud ecosystems (AWS GovCloud, Azure Government, Google Cloud Platform, Oracle Cloud Infrastructure) secured under the Joint Warfighter Cloud Capability, Thunderdome Zero Trust Network Access (ZTNA), and Microsoft Defender suite (EndGuard).· Analytic Capability & Use Case Development: Translate threat intelligence and adversary TTPs into specific detection use cases, rule logic, and detection requirements for ingestion into enterprise SIEMs (Splunk, Microsoft Sentinel, Elastic, and JCRS-D).· Aggregated Threat Trend Reporting: Aggregate threat indicators, malware behaviors, and adversary profiles from commercial threat feeds (e.g., CrowdStrike, VirusTotal) and internal investigations; provide inputs for the quarterly Aggregated Cyber Awareness Report detailing strategic threat forecasts and vulnerability exposures.· Vulnerability & Exposure Intelligence: Continuously assess Information Assurance Vulnerability Management notices (IAVAs and IAVBs) against active adversary exploitation trends, providing technical threat context and impact assessments to mission partner enclaves.3. Location-Specific & Above-Secret Intelligence: PACOM & TS/SCI· PACOM Mission Network (PMN) and Joint Operational Edge – Coalition Environment (JOE-CE) Threat Assessment: Provide dedicated cyber threat intelligence and behavioral profiling tailored to the PMN and JOE-CE operational networks.· User & Entity Behavioral Profiling: Analyze Identity, Credential, and Access Management telemetry and the PMN Master User Record to identify anomalous user behavior, insider threats, and sophisticated lateral movement.· SCIF-Based Intelligence Operations: Conduct all-source cyber analysis within Sensitive Compartmented Information Facilities (SCIF) at Ford Island, examining multi-discipline intelligence across JWICS, YLAN, and special-access enclaves up to Top Secret / SCI.· Cross-Echelon Coordination: Brief Senior Executive and military leadership across USPACOM, DISA PAC, and operational mission partners on adversary threat capabilities, active campaigns, and strategic risk postures. What You’ll Need for SuccessClearance & Citizenship· Citizenship: Must be a U.S. Citizen.· Clearance: Active Top Secret security clearance with eligibility to obtain SCI access upon start (adjudicated Tier 5 / SSBI investigation within scope). Candidates holding an active Secret clearance may be considered provided Top Secret/SCI processing begins immediately upon hire with government approval.Education & Experience Requirements· Bachelor’s degree with 4 years of relevant experience; OR an Associate degree with 6 years; OR 8 years of relevant experience / military service in lieu of a degree.Required DoD 8140 / 8570 Baseline Qualifications· Must hold a valid certification or degree compliant with DoD 8140.03 / DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent (Intermediate proficiency level) prior to start date:· Accepted Certifications include: CompTIA CySA , GCTI (GIAC Cyber Threat Intelligence), CEH, CFR, GCIA, GCIH, CND, or advanced credentials such as CISSP, CASP CE, or GCFA.· Privileged Access (SA/SSP) eligibility: Willingness to obtain and maintain system access credentials as required by operational mission requirements.Core Technical Competencies· In-depth understanding of adversary tactics, techniques, and procedures, threat actor attribution, and mapping adversary activity to the MITRE ATT&CK framework.· Experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.· Proven ability to analyze raw packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct adversary intrusions.· Hands-on familiarity querying enterprise SIEM platforms (Splunk SPL, Elastic/Kibana, Microsoft Sentinel KQL).· Working knowledge of common threat intelligence platforms and tools (e.g., MISP, ThreatConnect, Anomali, VirusTotal, Shodan).· Willingness and ability to work standard operational shifts with occasional surge/after-hours support during critical incidents or crisis contingencies. Preferred Qualifications· Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units (e.g., 10th Fleet, 16th Air Force, ARCYBER).· Experience conducting structured threat-hunting (DCI/DD) across cloud and enterprise on-premises networks.· Knowledge of malware triage and dynamic/static analysis concepts (e.g., sandboxing, de-obfuscation, hashing, C2 extraction).· Familiarity with AI prompting (Gemini, Grok, ChatGPT) for automation and OSINT data collection.· Direct background working with DoD incident response frameworks (CJCSM 6510.01F, DoDI 8530.01) and reporting platforms (Rally, DISS). Why Join Leidos on GSM-O II TN22?· Crucial Theater Mission: Directly defend warfighters and theater infrastructure across the most critical Indo-Pacific operational environment.· Advanced Cyber Ecosystem: Work at the confluence of enterprise-scale SIEM environments, Zero Trust architecture, and next-generation multi-cloud platforms.· Long-Term Program Stability: Backed by Leidos’s prime contract award on the GSM-O II Task Order 22 vehicle spanning a base year plus four option periods.· Professional Growth & Certification Sponsorship: Extensive tuition assistance, Leidos internal training academies, and corporate sponsorship for advanced SANS/GIAC technical cyber certifications.If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.Original Posting:October 28, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.Pay Range:Pay Range $87,100.00 - $157,450.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.