{"id":4112408,"url":"https://alion.io/job/leidos-cyber-intelligence-fusion-analyst-2","title":"Cyber Intelligence Fusion Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":77,"open_postings":326,"ghost_share":0.006,"stale_share":0.905,"repost_share":0.012,"time_to_fill_p50_days":27,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Alexandria, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":107900,"max":195050,"currency":"USD","period":"year","gross":null,"usd_annual":195050},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"Defense in Depth","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"TCP/IP","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false},{"name":"Active Directory","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"DNS","optional":true},{"name":"GCP","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"Microsoft Entra ID","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"Snort","optional":true},{"name":"Suricata","optional":true},{"name":"Sysmon","optional":true},{"name":"VirusTotal","optional":true},{"name":"Wireshark","optional":true},{"name":"YARA","optional":true},{"name":"YARA","optional":true}],"status":"live","first_seen_at":"2026-11-10T00:00:00Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-12T11:13:05Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Leidos has a current job opportunity for a Cyber Intelligence Fusion Analyst on the DISA GSM-O II TN24 Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports the J361 Security Operations Center (SOC) Fusion mission at the Mark Center, Alexandria, Virginia. The team operates 100% onsite at the Mark Center during normal business hours, Monday through Friday, 0600-1800.\nPosition Summary\nThe Cyber Intelligence Fusion Analyst serves as the proactive analysis and threat-hunting engine for the J361 SOC. The analyst synthesizes all-source threat reporting to conduct structured threat hunts, perform proactive environment sweeps, and deliver tailored analytical reports and briefings to senior leadership.\nThe position combines cyber operations, threat intelligence, and analytic tradecraft to identify, characterize, and mitigate threats affecting tenants and subscribers throughout the National Capital Region. Responsibilities include correlating external intelligence with enterprise telemetry, mapping adversary TTPs, recommending detections and countermeasures, and providing threat context during incident investigations across classified, unclassified, and cloud environments.\nPrimary Responsibilities\nIngest, analyze, and synthesize cyber threat reporting from OSINT, government reporting, commercial threat-intelligence platforms, and other authorized sources to identify threats relevant to the environment.\nCorrelate external threat intelligence with enterprise SIEM, EDR, endpoint, network, packet capture (PCAP), NetFlow, proxy, firewall, IDS/IPS, SSL/TLS inspection, session, and system-log telemetry to identify and assess malicious activity.\nConduct proactive IOC sweeps and hypothesis-driven threat hunts to identify activity associated with emerging adversary campaigns, vulnerabilities, malware, targeted threats, and stealthy or evasive adversary behavior.\nCharacterize adversary infrastructure, malware, tooling, and TTPs using MITRE ATT&CK, Cyber Kill Chain, and other applicable threat-modeling frameworks; assess potential risk to enterprise assets, tenants, and mission operations.\nDevelop hunt plans, adversary profiles, analytic methodologies, detection logic, and complex query strategies; plan, coordinate, and execute ad hoc threat hunts; and document findings and recommendations in after-action reports (AARs) and other required mission products.\nDevelop, validate, and recommend countermeasures, including SIEM correlation searches, analytic content, custom signatures, and blocking recommendations, to improve prevention, detection, and response to known adversarial TTPs; technically vet suspicious indicators before submitting detection or blocking nominations.\nProduce recurring and ad hoc threat reports, intelligence assessments, executive summaries, situational-awareness updates, time-sensitive threat notifications, and strategic threat assessments.\nTranslate technical telemetry, forensics, intelligence reporting, and analytic findings into clear, actionable technical, operational, and executive-level summaries; prepare and deliver recurring and on-demand briefings to leadership, tenant organizations, and mission partners.\nServe as a subject matter expert on adversary tradecraft and provide threat context, intelligence support, and analytic recommendations to incident responders and other SOC teams during active investigations.\nDevelop and maintain SOPs, work instructions, hunt methodologies, analytic playbooks, detection use cases, and knowledge-management artifacts; identify capability and workflow gaps, recommend improvements; and enhance automation for enrichment, case management, reporting, dashboards, and metrics.\nMeasure and improve hunt and detection coverage against prioritized adversary behaviors; maintain a repeatable hunt backlog that tracks hypotheses, data-source dependencies, findings, detection outcomes, unresolved gaps, and remediation recommendations.\nProvide technical leadership on complex hunts and investigations; mentor junior analysts and contribute to team training and professional development.\nBasic Qualifications\nBachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline and 8+ years of relevant experience; additional relevant experience, cybersecurity education, or industry certifications may be substituted for a degree. At least 4 years of this experience must include cybersecurity operations, cyber threat intelligence, threat hunting, incident response, cyber network defense, or a closely related cyber mission.\nActive Top Secret security clearance; must be a U.S. citizen.\nMust meet DoD 8140 IAT Level II baseline certification requirements before starting work and possess, or obtain and maintain within the required program timeframe, a DoD 8140 CSSP Analyst (CSSP-A) certification.\nDemonstrated experience applying MITRE ATT&CK, Cyber Kill Chain, or comparable frameworks to characterize adversary activity, TTPs, attack lifecycles, vulnerabilities, malware behaviors, and indicators.\nDemonstrated hands-on experience conducting end-to-end, hypothesis-driven threat hunts, including developing detection logic and analytic queries; pivoting from external threat reporting, indicators of compromise (IOCs), and open-source intelligence (OSINT) to internal enterprise telemetry; identifying required data sources; executing and refining queries; validating findings through endpoint, identity, and network telemetry; documenting analytic conclusions; and transitioning validated findings into detections, response actions, or follow-on collection requirements.\nDemonstrated experience with Windows and Linux host-based investigation artifacts, including process execution, command-line activity, persistence mechanisms, authentication events, scheduled tasks or services, PowerShell or shell activity, file-system artifacts, and endpoint detection and response (EDR) telemetry.\nExperience assessing telemetry quality and detection coverage against priority adversary techniques, including identifying collection gaps, data-normalization issues, blind spots, false-positive drivers, and recommendations for new or improved logging, analytic content, and hunt data sources.\nDemonstrated experience querying, analyzing, and correlating high-volume SIEM, EDR, endpoint, network, NetFlow, packet, log, and other host- or network-based security data; working knowledge of TCP/IP, common ports and protocols, network traffic flow, OSI model, system administration, defense-in-depth, and enterprise security architecture.\nStrong written, verbal, analytical, and collaboration skills, including the ability to produce technical and executive-level reports and briefings; ability to work independently, manage competing priorities, and work effectively with technical and non-technical mission partners.\nProficiency developing, testing, and tuning analytic queries and detection content using at least one relevant query language or scripting tool, such as Splunk Processing Language (SPL), Kusto Query Language (KQL), Elastic/Lucene query syntax, SQL, Python, PowerShell, and Unix/Linux command-line utilities.\nAbility to work 100% onsite at the Mark Center during normal business hours; schedule flexibility may be required to support mission requirements.\nPreferred Qualifications\nEligibility for TS/SCI access, including reciprocal acceptance, is preferred.\nAdvanced cybersecurity certifications, such as CISSP, CASP+, CySA+, CEH, GIAC GCIH, GCIA, GCED, GCTI, or comparable credentials.\nExperience supporting DISA, Department of Defense networks, Cyber Security Service Provider operations, Cyber Protection Teams, or a large enterprise SOC.\nExperience conducting threat hunting and cyber investigations across NIPRNet, SIPRNet, JWICS, cloud, commercial, or similarly complex enterprise environments.\nExperience producing intelligence products, operational reports, and executive briefings for senior executives, General Officer/Flag Officer, Senior Executive Service, or equivalent leadership; demonstrated ability to lead complex cyber investigations or threat hunts and mentor junior technical staff.\nExperience using SIEM, EDR, threat-intelligence, and network-analysis tools, such as Splunk, Elastic, Microsoft Defender for Endpoint, Microsoft Sentinel, Google Threat Intelligence, Virus Total, Wireshark, PCAP, and NetFlow, to develop or tune correlation searches, detection rules, signatures, threat blocks, analytic queries, dashboards, and automated enrichment workflows.\nExperience developing, validating, and maintaining detection content in portable or platform-specific formats, such as Sigma rules, YARA rules, Suricata/Snort signatures, SIEM correlation searches, EDR custom detections, and behavioral analytics.\nWorking knowledge of commercial threat-intelligence platforms, malware behavior analysis, digital and network forensic triage, endpoint telemetry, intrusion detection, vulnerability research, cloud security, and intelligence-driven defense methodologies.\nExperience conducting cloud and identity-focused threat hunting using identity, authentication, audit, and workload telemetry from Microsoft 365, Microsoft Entra ID, Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), or comparable enterprise cloud environments.\nExperience performing endpoint and network forensic triage to validate hunt findings, including review of process trees, memory or disk artifacts, Windows Event Logs, Sysmon, authentication logs, DNS, proxy, firewall, PCAP, and NetFlow data.\nExperience analyzing identity-based and lateral-movement behaviors, including suspicious authentication patterns, privileged-account use, remote execution, credential access, Active Directory enumeration, and persistence techniques.\nExperience with adversary emulation, purple-team exercises, or detection-validation activities that map simulated adversary behavior to MITRE ATT&CK techniques and measure detection coverage, analytic fidelity, and response readiness.\nExperience automating repetitive hunt, enrichment, and detection-engineering tasks through application programming interfaces (APIs), Python, PowerShell, SOAR playbooks, or case-management workflows.\nExperience operationalizing threat intelligence through indicator lifecycle management, including indicator validation, expiration, prioritization, enrichment, enterprise sweeping, and conversion of relevant intelligence into behavioral detections.\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nNovember 10, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\nPay Range $107,900.00 - $195,050.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":11619,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["National Security","C4ISR","Information Security","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-11-11T23:35:58Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":2,"expected_fill_days":27,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-12T10:38:37Z"},"pay":{"stated_usd_annual":195050,"is_top_pay":true},"html_url":"https://alion.io/job/leidos-cyber-intelligence-fusion-analyst-2","json_url":"https://alion.io/job/leidos-cyber-intelligence-fusion-analyst-2.json","meta":{"generated_at":"2026-11-12T14:44:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30677,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-cyber-intelligence-fusion-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-cyber-intelligence-fusion-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-cyber-intelligence-fusion-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-cyber-intelligence-fusion-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-cyber-intelligence-fusion-analyst-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4112408}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4112408},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}