{"id":3947636,"url":"https://alion.io/job/leidos-cyber-defence-analyst","title":"Cyber Defence Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":310,"ghost_share":0.003,"stale_share":0.881,"repost_share":0.013,"time_to_fill_p50_days":28,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chester, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":36900,"max":46100,"currency":"GBP","period":"year","gross":null,"usd_annual":61575},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"ITSM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Machine Learning","optional":true}],"status":"live","first_seen_at":"2026-11-06T00:00:00Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-10T03:18:14Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Cyber Defence Analyst\nLocation: Farnborough\nClearance - SC to start, DV for role\nUNLEASH YOUR POTENTIAL\nEverything we do is built on a commitment to do the right thing for our customers, our people and our community. Our mission and our values guide the way we do business. The foundations of our Leidos culture are our Values, Beliefs and Expectations by which we select, recognise and reward employees. They create the environment that drives us toward our mission.\nThe Cyber Defence Analyst protects customer services by identifying, investigating and helping to contain cyber threats across a 24x7x365 multi-customer CSOC.\nThe role converts security telemetry, threat intelligence and vulnerability information into timely, evidence-led decisions. Success is demonstrated through accurate alert disposition, complete incident records, decisive escalation, effective handovers and practical improvements to detection and response.\nTypically knowledge of CSOC or security operations experience, or credible transferable cyber security knowledge, qualifications and practical aptitude, supported by the motivation to develop quickly in the role.\nYour Key Outcomes and Responsibilities\nMonitor security alerts continuously and take timely, consistent action in line with agreed service priorities, protecting customer services and reducing the time threats remain undetected or uncontained.\nAnalyse alerts and supporting telemetry from SIEM, EDR and XDR platforms to establish the context, scope, severity and potential business impact of suspicious activity.\nDistinguish true positives from benign or false-positive activity, document an evidence-based rationale and escalate material risk without delay.\nCreate and maintain complete, accurate cyber security incident records in the relevant IT service management (ITSM) tool, ensuring that evidence, timestamps, affected assets, indicators, actions, ownership and escalation decisions support effective response, handover and audit.\nCorrelate logs and events across multiple sources to identify suspicious patterns, likely attack paths and Indicators of Compromise (IOCs), improving investigative confidence and speed.\nMap observed adversary behaviour to relevant MITRE ATT&CK tactics, techniques and sub-techniques, supporting consistent analysis, clearer communication and visibility of detection coverage.\nCreate, test and tune threat-hunting queries and, where appropriate, convert validated findings into detection rules that improve coverage, signal quality and analyst efficiency.\nApply Cyber Threat Intelligence (CTI) to investigations and hunting, translating relevant indicators, adversary behaviours and affected technologies into practical detection, prioritisation and response actions.\nAssess vulnerabilities in context, explaining likely impact, exposure, exploitability and available evidence of exploitation so that stakeholders can prioritise proportionate remediation.\nRecommend proportionate countermeasures and coordinate agreed containment, eradication and recovery actions to reduce risk and restore secure operations.\nProactively identify suspicious activity, exploitable vulnerabilities and security misconfigurations, enabling action before they result in material customer impact.\nApply incident response processes, playbooks and prioritisation criteria consistently; contribute evidence to root-cause analysis and lessons learned so that repeat risk is reduced.\nProduce concise, accurate incident records, reports and shift handovers that make decisions, actions, residual risks, ownership and next steps unambiguous.\nSafeguard customer information and maintain strict separation, confidentiality and professional discretion when working across multiple accounts.\nCollaborate with technical teams, customers and other stakeholders to drive investigations and agreed response actions to a controlled, documented conclusion.\nContribute to tabletop exercises, post-incident reviews and measurable service improvements that strengthen detection, response and operational resilience.\nTechnology and Process Experience\nExperience investigating security events and incidents in a CSOC or comparable environment, or demonstrable transferable skills and the ability to develop rapidly.\nWorking knowledge of Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender Vulnerability Management, Microsoft Azure and Amazon Web Services (AWS).\nExperience of proactive threat hunting and of using validated investigation outcomes to improve detection and response.\nUnderstanding of the Confidentiality, Integrity and Availability (CIA) triad and its practical application when assessing technical and business impact.\nCurrent awareness of malware, ransomware and advanced persistent threat activity affecting cloud and on-premises environments.\nPractical knowledge of MITRE ATT&CK and its use in describing tactics, techniques, sub-techniques and observed adversary behaviour.\nExperience working within change-controlled environments and following authorised operational procedures.\nExposure to HMG-classified systems or programmes is advantageous but not essential.\nUnderstanding of core networking concepts, including TCP/IP, DNS, HTTP/S, common ports and protocols, and how network and cloud security controls generate investigative evidence.\nAbility to interpret common endpoint, identity, cloud, network and application log sources and recognise where evidence gaps may limit investigative confidence.\nCommunication and Professional Skills\nCommunicates technical findings, risk and recommended actions clearly to technical and non-technical audiences through handovers, incident records, reports and stakeholder briefings.\nDemonstrates calm judgement and professional credibility when presenting evidence, challenging assumptions and making proportionate recommendations under pressure.\nBuilds trusted relationships with customers and internal stakeholders while maintaining appropriate confidentiality, account separation and professional boundaries.\nApproaches problems logically, tests assumptions and develops practical, prioritised remediation plans.\nManages competing priorities, recognises material risk and escalates decisively through the appropriate route when required.\nWorks effectively within a shift team and with minimal supervision, welcomes constructive feedback and respects differing viewpoints.\nTakes ownership, works through obstacles and drives agreed actions to completion, maintaining clear accountability throughout.\nMaintains relevant professional knowledge of cyber security threats, technologies and industry developments and applies it appropriately to the role.\nDemonstrates the reliability and flexibility needed to support the agreed shift rota and maintain continuous protection of customers.\nDepartment: CSOC - 24x7x365 multi-customer service\nSecurity Requirement: Candidates must be eligible and willing to obtain the level of SC and/or DV security clearance required for the programmes they support, and must meet applicable customer nationality requirements. Security clearance is not required on entry unless specified for a particular programme.\nOperating Model: On-site attendance is required for Monday-to-Friday day shifts. Homeworking may be permitted at other times where operationally appropriate, subject to business, security and customer requirements.\nWorking Model: 12-hour day and night shifts within the agreed rota.\nWhat we do for you:\nAt Leidos we are PASSIONATE about customer success, UNITED as a team and INSPIRED to make a difference. We offer meaningful and engaging careers, a collaborative culture, and support for your career goals, all while nurturing a healthy work-life balance.\nWe provide an employment package that attracts, develops and retains only the best in talent. Our reward scheme includes:\nContributory Pension Scheme\nPrivate Medical Insurance\n33 days Annual Leave (including public and privilege holidays)\nAccess to Flexible benefits (including life assurance, health schemes, gym memberships, annual buy and sell holidays and a cycle to work scheme)\nFlexi-TIme\nCommitment to Diversity:\nWe welcome applications from every part of the community and are committed to a truly diverse and inclusive culture. We foster a sense of belonging, welcoming all perspectives and contributions, and providing equal access to opportunities and resources for everyone. If you have a disability or need any reasonable adjustments during the application and selection stages please let us know, and we will respond in a way that best fits your needs.\nWho We Are:\nLeidos UK & EUROPE - we work to make the world safer, healthier, and more efficient through technology, engineering and science.\nLeidos is a growing company delivering innovative technology and solutions focused on safeguarding critical capabilities and transformation in frontline services, our work in the United Kingdom includes addressing some of the most complex problems in defence, healthcare, government, safety and security, and transportation.\nWhat Makes Us Different:\nPurpose: you can use your passion and abilities at Leidos to keep the people you care about safe. We are at the forefront of machine learning, AI, cyber security and solutions. Using your skills in the technology frontline by helping to build a safer world. You can inspire change.\nCollaboration: having flexibility to do your job is one of our core benefits, enabling you to become part of our extraordinary team. We have been empowering our people to work flexibly for years. Whether you work from home, the office or on customer sites, we will give you the digital tools and the flexibility to work smarter and align your needs and ours.\nPeople: Leidos empowers people from every background to be themselves and gives you the tools to learn new skills by enabling growth whilst developing. We believe that extraordinary people need opportunities to grow, to be inspired and to inspire others. At Leidos, we invest in technical academies, career rotations and a career development plans that enhance your future.\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nFor U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\n£36,900.00-£46,100.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":11140,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Gym membership","Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","National Security","C4ISR","Information Security"],"lifecycle":[{"event":"open","at":"2026-11-08T22:36:42Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.602,"p_room":1,"age_days":3,"expected_fill_days":28,"reasons":["conf:2","stale_co","win:early","comp:brand"],"computed_at":"2026-11-09T06:03:00Z"},"pay":{"stated_usd_annual":61575,"is_top_pay":false},"html_url":"https://alion.io/job/leidos-cyber-defence-analyst","json_url":"https://alion.io/job/leidos-cyber-defence-analyst.json","meta":{"generated_at":"2026-11-10T04:56:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11487,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-cyber-defence-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-cyber-defence-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-cyber-defence-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-cyber-defence-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-cyber-defence-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3947636}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3947636},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}