Threat Intelligence Platform Integrations Lead

Leidos; Whitehall (OH); Hybrid; USD 87,000 - 157,000; Full time

Job summary

Leidos in the United States seeks a Threat Intelligence Platform Integrations SME to own and sustain a Threat Intelligence Platform. You will fuse CTI data, implement blocking actions, and integrate feeds across multiple DISA capabilities to enhance DoWIN defenses.

The role requires active TS/SCI clearance, DoD/IC experience, and strong skills in Python, JSON, YAML, Git, and CTI deployment. Partial/hybrid on-site work is possible with a must-have on-site presence.

Qualifications

• Active TS/SCI clearance is required.
• Bachelor's degree with 4+ years of relevant experience, or equivalent experience.
• 2+ years with Threat Intelligence Platforms (TIPs) and threat feed integrations.
• Proficiency in Python programming.
• JSON and YAML configuration editing experience.
• Git or similar version control experience.
• Experience with CBII, Palo Alto, ERS, Versa integrations.
• 8140 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate level with one of listed certs.

Responsibilities

• Act as mission owner for sustained Threat Intelligence Platform support and CTI fusion.
• Integrate blocking capabilities and drive automated defense features.
• Fuse intelligence sources to develop products and provide strategic recommendations.
• Research threats and map adversary activities using MITRE ATT&CK framework.
• Analyze intelligence data to evaluate adversary capabilities, intentions, and tactics.
• Produce papers, presentations for senior government officials.
• Support IOC management, blocking, and general troubleshooting for stakeholders.

Skills

CTI fusion

Threat intelligence

DoD/IC experience

Strong communication

Security policy understanding

Education

Bachelor's degree in a related discipline

Tools

Python

JSON

YAML

Git

CBII

Palo Alto

ERS

Versa

Job description

Leidos in the United States seeks a Threat Intelligence Platform Integrations SME to own and sustain a Threat Intelligence Platform. You will fuse CTI data, implement blocking actions, and integrate feeds across multiple DISA capabilities to enhance DoWIN defenses.

The role requires active TS/SCI clearance, DoD/IC experience, and strong skills in Python, JSON, YAML, Git, and CTI deployment. Partial/hybrid on-site work is possible with a must-have on-site presence.