Threat-Hunting Cyber Intelligence Fusion Analyst

Leidos LLC; Alexandria (VA); On-site; USD 108,000 - 195,000; Full time

Benefits offered by this job

Health benefits

Retirement program

Job summary

Leidos is actively seeking a Cyber Intelligence Fusion Analyst to support the J361 SOC Fusion mission at the Mark Center in Alexandria, VA. This role is 100% onsite during normal business hours, Monday through Friday, and requires an active Top Secret clearance with SCI eligibility.

The analyst will conduct threat hunting, analyze all-source threat reporting, and develop detection logic and analytic content to protect tenants and mission operations in the National Capital Region.

Qualifications

• Active Top Secret security clearance or ability to obtain SCI.
• Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or related technical discipline with 8+ years of relevant experience.
• 4+ years of experience in cybersecurity operations, threat intelligence, threat hunting, or incident response.

Responsibilities

• Ingest, analyze, and synthesize cyber threat reporting from OSINT, gov't reporting, and commercial platforms to identify threats.
• Correlate external threat intel with SIEM/EDR/endpoint logs and network telemetry to assess malicious activity.
• Conduct hypothesis-driven threat hunts to identify activity associated with adversary campaigns and vulnerabilities.
• Characterize adversary infrastructure and TTPs using MITRE ATT&CK, Cyber Kill Chain, and other frameworks.
• Develop hunt plans, detection logic, and complex query strategies; document findings and recommendations in AARs.
• Produce recurring and ad hoc threat reports and executive summaries; deliver briefings to leadership and mission partners.

Skills

Threat hunting

Analytical thinking

Executive briefing

Technical leadership

Education

Bachelor's degree in cybersecurity or related field

Tools

Splunk

Elastic

Microsoft Defender for Endpoint

PowerShell

SPL/KQL

Job description

Leidos is actively seeking a Cyber Intelligence Fusion Analyst to support the J361 SOC Fusion mission at the Mark Center in Alexandria, VA. This role is 100% onsite during normal business hours, Monday through Friday, and requires an active Top Secret clearance with SCI eligibility.

The analyst will conduct threat hunting, analyze all-source threat reporting, and develop detection logic and analytic content to protect tenants and mission operations in the National Capital Region.