Senior Cyber Threat Intelligence Engineer

Relha LLC; Annapolis (MD); Hybrid; USD 93,000 - 155,000; Full time

Benefits offered by this job

Health insurance

401k matching program

Job summary

Northrop Grumman is seeking a Principal Cyber Intelligence Analyst to support the CISO & Global Cybersecurity Operations Center. The role emphasizes monitoring, detection, and rapid response to cyber threats, with an emphasis on automating alert fatigue and integrating new cyber capabilities.

Qualified candidates will possess a TS/SCI clearance, experience in defensive operations, and the ability to develop and deploy detection tools across Windows, Linux, AWS, and Azure environments.

Qualifications

• Minimum 8 years of relevant experience with an Associates in related fields; 5 years with a Bachelors; 3 years with a Masters; 1 year with a PhD.
• Candidate must hold a current U.S. Government Top Secret security clearance with SCI access and a recent polygraph adjudicated within 5 years.
• Fluency in offensive cyber TTPs and strong defensive cyber operations foundations.

Responsibilities

• Monitor, investigate, and respond to cyber threat alerts on unclassified and classified networks.
• Create and tune cyber threat detection rules across platforms.
• Conceptualize, build and integrate tools to enhance defensive cyber operations.
• Collaborate with cyber, technical, and non-technical teams on incident response and DevSecOps in various environments.
• Work flexible hours including in-office, SCIF, or home as needed.

Skills

Cybersecurity

Threat hunting

SIEM

DevSecOps

Incident response

Cloud security

Python/ scripting

Education

Associates in Computer Science

Bachelors in Computer Science

Tools

SIEM

EDR

Yara

SOAR

Splunk

Job description

Northrop Grumman is seeking a Principal Cyber Intelligence Analyst to support the CISO & Global Cybersecurity Operations Center. The role emphasizes monitoring, detection, and rapid response to cyber threats, with an emphasis on automating alert fatigue and integrating new cyber capabilities.

Qualified candidates will possess a TS/SCI clearance, experience in defensive operations, and the ability to develop and deploy detection tools across Windows, Linux, AWS, and Azure environments.