Threat-Hunting Cyber Intelligence Fusion Analyst

Leidos; Alexandria (VA); On-site; USD 108,000 - 195,000; Full time

Job summary

Leidos is seeking a Cyber Intelligence Fusion Analyst to support the J361 SOC Fusion mission from the Mark Center in Alexandria, VA. The role focuses on proactive threat hunting, synthesis of all-source intelligence, and development of detections across classified and cloud environments.

The analyst will integrate OSINT, government reporting, and enterprise telemetry to deliver actionable insights, brief senior leadership, and guide incident response across multiple domains.

Qualifications

• Bachelor’s degree in a technical discipline and 8+ years of relevant experience; substitutions allowed.
• 4+ years of cybersecurity operations, threat intelligence, threat hunting, incident response, or related work.
• DoD 8140 IAT II baseline and CSSP Analyst certification requirements.
• Experience with MITRE ATT&CK, Cyber Kill Chain, or similar frameworks.
• Experience analyzing high-volume security data (SIEM/EDR/NetFlow/PCAP).
• Strong written and verbal communication; able to brief leadership.

Responsibilities

• Ingest and analyze threat reporting from OSINT, gov, and commercial sources to identify relevant threats.
• Correlate threat intelligence with SIEM/EDR and network telemetry to assess malicious activity.
• Conduct threat hunts and develop detections, signatures, and enrichment workflows.
• Characterize adversary infrastructure, tooling, and TTPs using MITRE ATT&CK and related models.
• Develop hunt plans, analytics, and SOPs; document findings in AARs and mission products.
• Provide threat context during investigations and brief leadership and partners.

Education

Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline

Tools

Splunk

Elastic

Microsoft Defender for Endpoint

Microsoft Sentinel

Wireshark

PCAP

NetFlow

SQL/Python/PowerShell

Job description

Leidos is seeking a Cyber Intelligence Fusion Analyst to support the J361 SOC Fusion mission from the Mark Center in Alexandria, VA. The role focuses on proactive threat hunting, synthesis of all-source intelligence, and development of detections across classified and cloud environments.

The analyst will integrate OSINT, government reporting, and enterprise telemetry to deliver actionable insights, brief senior leadership, and guide incident response across multiple domains.