{"id":165054,"url":"https://alion.io/job/leidos-cyber-real-time-analyst","title":"Cyber Real-Time Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":79,"open_postings":237,"ghost_share":0.004,"stale_share":0.84,"repost_share":0.004,"time_to_fill_p50_days":27,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Pearl Harbor, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":69550,"max":125725,"currency":"USD","period":"year","gross":null,"usd_annual":125725},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-08-10T00:00:00Z","employer_posted_date":"2026-08-10","last_verified_at":"2026-10-21T22:43:03Z","board_verified":true,"closed_at":null,"days_open":72,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":72},"description":"Join the Team Defending the Pacific's Front Line in Cyberspace\nLeidos is hiring Real Time Analysts to join the Network Assurance Team supporting DISA Pacific (DNC-PAC) at Ford Island, Joint Base Pearl Harbor-Hickam. This team serves as the Security Operations Center (SOC) for USPACOM and the broader DoD Information Network (DODIN/DISN), standing watch 24/7/365 to detect, analyze, and respond to threats against the boundary of the Department of Defense's global network.\nYou'll work at the intersection of two missions: the established DISA SOC boundary defense operation that protects the DODIN's Pacific footprint, and the emerging Joint Fires Network (JFN) Security Operations Center supporting a next generation, TS/SCI-level sensor and detection environment being stood up at the same location.It'sa rare opportunity to defend mature, mission-critical infrastructure while helping build a brand-new SOC capability from the ground up.\nWhat You'll Do:\nBoundary Cyber Defense & SOC Operations\nMonitor, detect, and analyze intrusions, incidents, and threats across the DODIN/DISN boundary - Internet Access Points, Boundary Cloud Access Points, and related infrastructure - using DoD-approved network monitoring and traffic analysis tools on a 24/7/365 basis.\n\nPerform near real-time triage of security events, correlating alerts,netflow, IDS/IPS output, and raw packet captures to confirm or refute malicious activity.\n\nConduct deep-dive analysis of “low and slow” activity to uncover unauthorized access that automated tools miss.\n\nInvestigate and analyze events using SIEM platforms including Splunk, Elastic, and Microsoft Sentinel, and correlate sensor data through the ThunderDome cybersecurity suite.\n\nApply the MITRE ATT&CK framework to characterize adversary tactics, techniques, and procedures, and to guide incident analysis and threat-hunting.\n\nDevelop, tune, and recommend custom detection signatures and countermeasures to prevent or mitigate emerging threats.\n\nDocument analysis and findings in the DoD-mandated incident reporting/ticketing system, and issue Situational Awareness Reports and TIPPERs to mission partners.\n\nCoordinate directly with the DISA Joint Operations Center (DJOC), USCYBERCOM, and peer SOCs to synchronize threat intelligence and incident response across the DODIN.\n\nJoint Fires Network (JFN) SOC Support\nSupport stand-up and sustainment of a 24x7x365 Security Operations Center for the JFN IL-6 environment, focused on threat detection and continuous monitoring across JFN nodes.\n\nConduct Syslog review and Elastic stack alerting toidentifyanomalies, andtune advanced sensors such asCorelightas the SOC matures.\n\nTriage, escalate, and track incidents through JIRA using standardized SOC intake and escalation processes.\n\nHandle TS/SCI-level incidentsin accordance withDIA-aligned requirements, ensuring spills, breaches, or anomalies are reported through authorized channels within mandated timelines.\n\nDevelop threat-hunting playbooks focused on behavioral anomalies and traffic pattern analysis as the mission matures frominitialmonitoring into full detection and response.\n\nWork from a Sensitive Compartmented Information Facility (SCIF) at DISA Pacific, Ford Island.\n\nWhat You'll Need for Success:\nActive Top Secret security clearance with eligibility/ability to obtain SCI\n\nEducation and experience requirements depending on job level, as follows: Level II: Bachelor's degree and 2+ years of relevant experience; equivalent work experience and/or military service may be considered in lieu of a degree. \nLevel III: Bachelor's degree and 4+ years of relevant experience; equivalent work experience and/or military service may be considered in lieu of a degree. \n\nQualifications/credentials compliant with DoD 8140 DCWF Code 531, Cyber Defense Analyst at the Intermediateproficiencylevel.\n\nHands-on experience with Computer Network Defense duties - protect, defend, respond, and sustain.\n\nStrong networking fundamentals, including communication protocols and common security tooling (IDS/IPS, firewalls).\n\nExperience evaluating packet captures and analyzing raw network traffic.\n\nWillingness and ability to work rotating shifts in support of 24/7/365 operations, including some after-hours and surge support.\n\nPreferred Qualifications\nAI capability development and implementation to automate analysis and detection tasks.\n\nWorking knowledge of adversary tactics, techniques, and procedures (TTPs), and familiarity with MITRE ATT&CK and the Cyber Kill Chain.\n\nDirect experience with Splunk, Elastic, or similar SIEM/detection platforms.\n\nFamiliarity with JIRA-based incident workflows and/or SOC intake and escalation processes.\n\nUnderstanding of software exploits, and experience analyzing packed or obfuscated code.\n\nWhy This Role?\nDirect, high-visibility mission impact defending USPACOM and DODIN/DISN infrastructure in a strategically critical theater.\nGround-floor opportunity to help build a new SOC capability alongside an established, mature SOC operation.\nDaily collaboration with DISA, USCYBERCOM, and Government leadership - direct exposure to enterprise-level cyber defense decision-making.\nLong-term program stability: multi-year task order (base plus fouroptionyears) with an established incumbent team.\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nAugust 10, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\nPay Range $69,550.00 - $125,725.00The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":6343,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["National Security","C4ISR","Incident Response","Engineering Services"],"lifecycle":[{"event":"open","at":"2026-08-10T00:00:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":9,"band":"cold","label":"Long shot","p_open":1,"p_active":0.336,"p_room":0.28,"age_days":72,"expected_fill_days":27,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":125725,"is_top_pay":false},"html_url":"https://alion.io/job/leidos-cyber-real-time-analyst","json_url":"https://alion.io/job/leidos-cyber-real-time-analyst.json","meta":{"generated_at":"2026-10-21T23:48:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33981,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-cyber-real-time-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-cyber-real-time-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-cyber-real-time-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-cyber-real-time-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-cyber-real-time-analyst"}]}