Cybersecurity Analyst Intern

Leidos; Sunset (AR); On-site; USD 48,000 - 87,000; Full time

Job summary

Leidos, a leading defense, intelligence, and technology company, is seeking motivated cybersecurity students for our Summer 2027 Internship Program as a Cybersecurity Analyst Intern on the GSM-O II contract at Hill AFB, UT. You will work with SOC analysts, analyze security alerts, review logs, and help produce incident reports to support DoD networks.

The program offers hands-on experience with enterprise security tools, threat intelligence, and containment strategies while developing essential

Qualifications

• Pursuing a degree in Cybersecurity, CS, CE, or IT.
• Solid understanding of networking and security concepts.
• Familiarity with cyber defense frameworks and incident response.

Responsibilities

• Triage and analyze security alerts from SIEM/IDS/NetFlow to identify malicious activity.
• Assist in network traffic analysis and correlate security events.
• Shadow incident response and support containment, eradication, and recovery efforts.
• Review open-source threat intel and identify indicators of compromise to improve detections.

Skills

TCP/IP fundamentals

OSI model

Threat analysis

Documentation

Team collaboration

Security clearance eligible

Scripting basics

Education

Pursuing degree in Cybersecurity or CS

Tools

Splunk

Elastic

Packet analysis

Unix/Linux

Job description

Leidos, a leading defense, intelligence, and technology company, is seeking motivated and aspiring cybersecurity students for our Summer 2027 Internship Program (Starts May 2027). As a Cybersecurity Analyst Intern, you will join our Digital Sector on the Global Solutions Management – Operations II (GSM-O II) contract at Hill AFB, UT. This is a unique opportunity to gain hands‑on experience in a real‑world security environment, contributing to the operations, sustainment, and active defense of the Defense Information System Network (DISN) in support of the Defense Information Systems Agency (DISA).

Your Opportunity:

Are you ready to move beyond the classroom and hunt for real‑world threats? As a member of our Hill AFB cybersecurity team, you will be embedded directly with seasoned Security Operations Center (SOC) analysts who protect and defend critical DoD infrastructure. You will gain exposure to enterprise‑grade security tools, threat intelligence analysis, and incident response strategies, gaining hands‑on cyber operations experience that truly matters.

What You’ll Do (Potential Projects & Learning Opportunities):

• Learn to triage and analyze security alerts from various sources (SIEM, IDS/IPS, NetFlow) to identify potential malicious activity on customer networks.
• Assist senior analysts in performing network traffic analysis and correlating actionable security events using raw packet data and custom sensor outputs.
• Shadow incident response efforts, learning how the team coordinates resources during containment, eradication, and recovery activities.
• Gain exposure to cyber threat intelligence by reviewing open‑source feeds and learning how to identify Indicators of Compromise (IOCs) to improve detection capabilities.
• Practice conducting preliminary analysis of potential security incidents, such as investigating suspicious network connections and reviewing system logs for anomalous activity.
• Help create clear, concise technical documentation and incident reports for leadership and mission partners.

What You’ll Bring (Required):

• Citizenship & Clearance: Must be a U.S. citizen and eligible to obtain a DoD Secret security clearance.
• Education: Currently pursuing a degree in a relevant field such as Cybersecurity, Computer Science, Computer Engineering, or Information Technology.
• Technical Foundation: A solid understanding of TCP/IP protocols, common networking ports (e.g., 80, 443, 21, 22), the OSI model, and principles of defense‑in‑depth.
• Cyber Frameworks: Academic knowledge of the Cyber Kill Chain methodology and/or the MITRE ATT&CK framework, and basic malware analysis concepts (static/dynamic analysis).
• Analytical Mindset: A proactive, eager‑to‑learn attitude with the ability to analyze security alerts and identify potential false positives.
• Teamwork: A collaborative attitude with strong written and verbal communication skills.
• Location: This internship is based on‑site at Hill AFB, UT. All work must be performed on site – no teleworking opportunities. Candidates must have their own reliable transportation to and from the facility at Hill AFB, UT.

What We Want (Desired):

• Certifications: Obtaining a CompTIA Security+ or CySA+ certification (or any certification that aligns with DoD 8570 IAT Level II) before the start date is strongly encouraged.
• Hands‑On Experience: Prior experience from home labs (e.g., VirusTotal, basic sandboxing), Capture the Flag (CTF) competitions, or class projects involving network defense.
• Familiarity with:
  • Enterprise SIEM platforms like Splunk or Elastic.
  • Unix/Linux command line environments and Windows system administration.
  • Basic scripting and programming (e.g., Python, Bash).
  • Computer Network Defense (CND) domains: Protect, Detect, Respond, and Sustain.

If you’re looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We’re not hiring followers. We’re recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We’re already at step 30 — and moving faster than anyone else dares.

Pay Range:

Pay Range $48,100.00 - $86,950.00

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.