Cyber Threat Intelligence Analyst III

General Dynamics Information Technology, Inc.; Washington (District of Columbia); On-site; USD 123,000 - 167,000; Full time

Job summary

General Dynamics Information Technology, Inc. in Washington, DC seeks a Cyber Threat Intelligence Analyst III to produce timely, accurate threat intelligence supporting national cyber operations. The analyst fuses classified and open-source data, supporting watch floors and incident teams with threat context.

The role requires 5+ years of cyber threat intelligence experience, TS clearance, and onsite work at DHS and other agencies in the National Capital Region. Travel up to 25% may be required.

Qualifications

• Bachelor's degree in Intelligence Studies, Cybersecurity, Computer Science, International Relations, or equivalent experience.
• Minimum 5 years of experience in cyber threat intelligence analysis.
• Working knowledge of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain.
• Experience with threat intelligence platforms and STIX/TAXII.
• Experience writing intelligence products for senior government leaders.
• Active Top Secret clearance; TS/SCI eligibility.
• Ability to work onsite at DHS Headquarters and other agency sites in the National Capital Region.

Responsibilities

• Threat Monitoring & Analysis: continuously monitor intelligence, open-source, media, law enforcement, and partner reporting.
• Analyze threat actors, campaigns, and tactics, techniques, and procedures, and map them to MITRE ATT&CK.
• Produce weekly and monthly intelligence updates, leadership notes, threat summaries, and rapid briefings.
• Contribute threat content to alerts, advisories, and partner communications.
• Follow classification review and downgrade procedures so products can be shared at the right level.
• Align products to the agency's existing critical information requirements and essential elements of information.
• Incident & Operations Support: provide threat context to triage and incident management, including indicators and actor attribution where supported.
• Give hunt and response teams leads drawn from intelligence reporting.
• Support surge and crisis action activities during significant incidents.
• Critical Infrastructure Context: help analyze threats against critical infrastructure sectors, their dependencies, and potential consequences.
• Contribute to operational and strategic reporting on critical infrastructure threats and vulnerabilities.
• Tools & Data: use and help improve threat intelligence platforms and sharing standards such as STIX and TAXII.
• Review AI-generated summaries and enrichment for accuracy before release.

Skills

Cyber Operations

Cyber Threat Analysis

Cyber Threat Intelligence

Intelligence Reports

Threat Monitoring

Education

Bachelor's degree in Intelligence Studies, Cybersecurity, Computer Science, International Relations, or a related field

Tools

Threat intel platforms

STIX/TAXII

Palantir

ICD 203/206

Job description

Type of Requisition:

Regular Clearance Level Must Currently Possess: Top Secret Clearance Level Must Be Able to Obtain: Top Secret/SCI Public Trust/Other Required: None

Job Family:

Intelligence Operations and Analysis

Job Qualifications:

Skills: Cyber Operations, Cyber Threat Analysis, Cyber Threat Intelligence, Intelligence Reports, Threat Monitoring Certifications: None Experience: 5 + years of related experience US Citizenship Required: Yes

Job Description:

Position Summary The Cyber Threat Intelligence Analyst III produces timely, accurate threat intelligence that supports a DHS agency's national cyber operations. The analyst fuses classified and unclassified intelligence, open-source, law enforcement, and partner reporting into products that help leaders and operators understand who is acting, how, and what is at risk. The analyst works closely with watch floor, incident management, and hunt and response teams, adding threat context to active incidents and keeping leadership informed through regular and short-turn products.

Key Responsibilities

Threat Monitoring & Analysis Continuously monitor intelligence, open-source, media, law enforcement, and partner reporting. Analyze threat actors, campaigns, and tactics, techniques, and procedures, and map them to MITRE ATT&CK. Assess relevance of threats to federal, state, local, tribal, territorial, and critical infrastructure partners. Apply structured analytic techniques and clearly state confidence and sourcing. Intelligence Products & Leadership Support Produce weekly and monthly intelligence updates, leadership notes, threat summaries, and rapid briefings. Contribute threat content to alerts, advisories, and partner communications. Follow classification review and downgrade procedures so products can be shared at the right level. Align products to the agency's existing critical information requirements and essential elements of information. Incident & Operations Support Provide threat context to triage and incident management, including indicators and actor attribution where supported. Give hunt and response teams leads drawn from intelligence reporting. Support surge and crisis action activities during significant incidents. Critical Infrastructure Context Help analyze threats against critical infrastructure sectors, their dependencies, and potential consequences. Contribute to operational and strategic reporting on critical infrastructure threats and vulnerabilities. Tools & Data Use and help improve threat intelligence platforms and sharing standards such as STIX and TAXII. Review AI-generated summaries and enrichment for accuracy before release.

Required Qualifications

Bachelor's degree in Intelligence Studies, Cybersecurity, Computer Science, International Relations, or a related field, or equivalent experience. Minimum 5 years of experience in cyber threat intelligence analysis. Working knowledge of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain. Experience with threat intelligence platforms and STIX/TAXII. Experience writing intelligence products for senior government leaders. Experience working with classified intelligence reporting. Active Top Secret (TS) clearance. Eligibility to obtain and maintain TS/SCI access. Ability to work onsite at DHS Headquarters and other agency sites in the National Capital Region.

Preferred Qualifications

Experience at DHS, CISA, the Intelligence Community, DoW, or FBI cyber components. Experience analyzing threats to critical infrastructure, including industrial control systems and operational technology. Experience using Palantir or other enterprise analytics platforms for intelligence analysis. Experience reviewing or validating AI-assisted analysis.GCTI, CTIA, or similar certifications. Experience applying Intelligence Community analytic and sourcing standards (ICD 203 and ICD 206). Experience managing intelligence requirements and requests for information, including tracking whether products met the need. Familiarity with MITRE ATT&CK for IC's. Ability to support nights, weekends, holidays, on-call, and work at a continuity site during emergencies. Current DHS suitability (Entry on Duty) determination. Experience handling information under the Traffic Light Protocol and controlled unclassified information (CUI) markings.

The likely salary range for this position is $123,250 - $166,750.

This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Scheduled Weekly Hours:

40

Travel Required:

10-25%

Telecommuting Options:

Onsite

Onsite Work Location:

USA DC Washington

Additional Work Locations:

Total Rewards at GDIT: Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.

Our Identity Verification Process:

As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.

About Our Work:

We are GDIT. A global technology and professional services company that delivers technology solutions and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50+ countries worldwide, offering leading mission-ready capabilities in AI, cloud, cyber and software development. Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc.

Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans Opportunity Owned From working with technologies like AI, cyber and cloud to careers in intelligence and health, we offer endless opportunities to apply your expertise to create a safer, smarter world.

For more information about GDIT's Privacy Policy, click here: Privacy Policy | GDIT