Onsite SOC Threat-Hunting & Intelligence Fusion Analyst

Leidos Inc; Alexandria (VA); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Cyber Intelligence Fusion Analyst for the DISA GSM-O II program. The role supports the J361 SOC Fusion mission at the Mark Center, Alexandria, VA, operating 100% onsite during business hours.

You will synthesize all-source threat reporting, conduct structured threat hunts, and deliver tailored briefings to senior leadership. The role requires DoD clearance, advanced threat intelligence, and hands-on experience with SIEM/EDR, MITRE ATT&CK, and threat-hunting techniques.

Qualifications

• Active Top Secret clearance; SCI eligibility preferred.
• Bachelor's degree in cybersecurity, information technology, computer science, intelligence studies, or related field and 8+ years of relevant experience.
• 4+ years in cybersecurity operations, threat intelligence, or incident response.
• DoD 8140 IAT Level II baseline; CSSP Analyst certification preferred.
• MITRE ATT&CK, Cyber Kill Chain or similar framework experience.
• Experience with high-volume SIEM/EDR data and enterprise telemetry.
• Ability to work onsite at the Mark Center, Alexandria, VA.

Responsibilities

• Ingest and analyze cyber threat reporting from OSINT, government, and commercial sources to identify threats.
• Correlate threat intel with SIEM/EDR/NetFlow/PCAP telemetry to assess malicious activity.
• Conduct threat hunts and develop detections, signatures, and analytic queries.
• Characterize adversary infrastructure, malware, and TTPs using MITRE frameworks.
• Develop hunt plans, playbooks, and dissemination of findings in AARs and briefings.
• Provide threat context during incidents and mentor junior analysts.

Skills

Threat hunting

Threat intelligence

Analytic tradecraft

Executive briefings

Education

Bachelor's degree in cybersecurity or related field

Tools

Splunk

Elastic

Microsoft Defender for Endpoint

Microsoft Sentinel

Wireshark

PCAP

NetFlow

Job description

Leidos is seeking a Cyber Intelligence Fusion Analyst for the DISA GSM-O II program. The role supports the J361 SOC Fusion mission at the Mark Center, Alexandria, VA, operating 100% onsite during business hours.

You will synthesize all-source threat reporting, conduct structured threat hunts, and deliver tailored briefings to senior leadership. The role requires DoD clearance, advanced threat intelligence, and hands-on experience with SIEM/EDR, MITRE ATT&CK, and threat-hunting techniques.