{"id":3947634,"url":"https://alion.io/job/leidos-cyber-threat-intelligence-analyst-2","title":"Cyber Threat Intelligence Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":77,"open_postings":330,"ghost_share":0.003,"stale_share":0.888,"repost_share":0.012,"time_to_fill_p50_days":28,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Chester, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ITSM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Nessus","optional":false},{"name":"STIX","optional":false},{"name":"TAXII","optional":false},{"name":"Machine Learning","optional":true},{"name":"MISP","optional":true}],"status":"live","first_seen_at":"2026-11-06T00:00:00Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-10T09:23:34Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Cyber Threat Intelligence (CTI) Analyst with Vulnerability Assessment and Vulnerability Management Responsibility\nLocation: Farnborough\nClearance - SC to start, DV for role\nEverything we do is built on a commitment to do the right thing for our customers, our people and our community.\nOur mission and our values guide the way we do business. The foundations of our Leidos culture are our Values, Beliefs and Expectations by which we select, recognise and reward employees. They create the environment that drives us toward our mission.\nYour role and responsibilities:\nThis is a pivotal Cyber Threat Intelligence role within a 24x7x365 CSOC. You will deliver targeted, customer-relevant threats and vulnerability intelligence that enables timely defensive decisions and strengthens cyber resilience. You will convert customer, sector, adversary, and vulnerability intelligence into clear priorities for detection, threat hunting, incident readiness, and remediation. The role focuses on:\nExploit-prevention-led intelligence that helps reduce credible attack paths before impact.\nRapid, proportionate response to zero-day and emerging vulnerability events.\nTranslation of geopolitical, sector and technical developments into customer-relevant cyber risk and action.\n2) Intelligence Delivery Approach\nYour mission is to turn relevant internal and external developments into customer-specific defensive advantage:\nCustomer and Sector Context: Maintain an informed view of customer environments, critical services, technologies, and sector threat conditions.\nAdversary Relevance: Assess the actors, motivations, campaigns, and outcomes most relevant to each customer.\nThreat Behaviour: Use recognised frameworks, including MITRE ATT&CK, to describe adversary behaviour and identify defensive opportunities.\nVulnerability Intelligence: Assess vulnerabilities, exploitation evidence, threat relevance, potential impact, and customer exposure.\nCSOC Integration: Ensure intelligence supports detection, hunting, incident handling, and operational decision-making.\nPreventive Outcomes: Inform proportionate vulnerability treatment and risk reduction through established VA/VM and service-management processes.\n3) Key Responsibilities (Outcome-led)\nA. Customer → Sector → Adversary Intelligence (Targeted CTI Delivery)\nBuild and maintain customer and sector intelligence profiles covering relevant threats, attack paths, critical technologies, and exposure.\nProduce strategic, operational, and tactical intelligence that informs defensive decisions, detections, hunts, and readiness.\nDeliver timely, evidence-led outputs with clear confidence assessments and proportionate actions.\nIdentify and analyse relevant threat actors, campaigns, malware, and infrastructure.\nB. Threat Behaviour and Defensive Relevance\nUse MITRE ATT&CK to connect actor and campaign activity with techniques, defensive coverage, and hunting opportunities.\nMaintain structured analysis that supports early warning, prioritisation and repeatable operational use.\nC. Exploit and Vulnerability Intelligence (VA/VM)\nDeliver exploit-informed vulnerability intelligence, assessing technical severity, exploitation potential, credible attack paths and service or data impact.\nEvaluate evidence of exploitation, relevant threat interest, available exploit capability, customer exposure, existing controls, and operational impact.\nAnalyse root cause, exploitation mechanics, chaining opportunities, and attacker workflow where required to support defensible decisions.\nD. Zero-day Response and Vulnerability Management\nLead monitoring and rapid advice for zero-day and emerging vulnerabilities, defining customer impact, priority, and proportionate defensive recommendations.\nSupport vulnerability actions through established governance and service management processes, maintaining accountability and traceability.\nContribute to Vulnerability Management Working Groups through agendas, actions, management information, and trend analysis.\nE. Operationalisation into the CSOC Toolchain (Detection & Automation)\nCollect and assess intelligence from approved open, commercial, internal and specialist sources, applying relevance and quality controls.\nManage indicators and intelligence through their lifecycle, including confidence, attribution, review, and false-positive reduction.\nEnable effective use of curated intelligence within approved CSOC platforms, including Microsoft Sentinel and Microsoft Defender where appropriate.\nPartner with detection, engineering and automation colleagues using structured sharing, STIX/TAXII 2.x, APIs, webhooks and Logic Apps/playbooks where applicable.\nF. Customer Engagement & Reporting (Trusted Advisor, No Alarmism)\nProduce customer-ready executive and technical intelligence products covering threats, campaigns, and vulnerabilities.\nExplain risk, impact, confidence, and required decisions clearly to leadership, operational and engineering audiences.\nWork calmly under pressure, handling challenging discussions with diplomacy and sound professional judgement.\nG. Service Maturity & Differentiation\nSustain consistent, efficient, and customer-relevant CTI delivery across multi-customer MSSP operations, with appropriate data separation and prioritisation.\nIdentify opportunities that shorten time to action, support automation and strengthen measurable cyber resilience.\n4) Measures of Success\nWithin 3-6 months, you will have:\nEstablished reliable customer and sector intelligence baselines.\nDelivered vulnerability intelligence that informs remediation priorities and reduces material exposure.\nEmbedded relevant CTI into detection, hunting, enrichment, and vulnerability-management activity.\nProduced consistent, high-quality intelligence that enables timely customer action.\nOngoing, success will be demonstrated through:\nTimely and effective responses to exploited or high-likelihood vulnerabilities.\nDefensive coverage and detection or hunting outcomes informed by CTI.\nIntelligence outputs that lead to tracked defensive or risk-reduction actions.\nClear, proportionate advice that sustains customer trust without unnecessary alarmism.\nAutomation-ready workflows, playbook steps, and integration pathways that reduce time to action.\n5) Key Deliverables\nCustomer and sector intelligence profiles defining relevant threats, exposures, and priority intelligence needs.\nStrategic, operational, and tactical intelligence products with evidence, confidence, and recommended actions.\nExploit-informed vulnerability and zero-day advisories with clear impact and risk-reduction priorities.\nMITRE ATT&CK-based analysis connecting relevant threats to defensive opportunities.\nCurated intelligence and indicator packages suitable for approved CSOC platforms.\nVulnerability-management reporting, working-group support, actions, and trend analysis.\n6) Essential Experience and Technical Capability\nCTI and Vulnerability Intelligence\nProven CTI delivery experience in a SOC or CSOC, with demonstrable operational outcomes.\nAbility to translate intelligence into clear defensive actions and decisions.\nStrong technical understanding of vulnerabilities, exploitation concepts, chaining, credible attack paths and business or service impact.\nExperience producing customer-specific exposure assessments and proportionate remediation priorities.\nExperience supporting rapid responses to zero-day or emerging vulnerability events across multiple stakeholders.\nExperience using vulnerability assessment or management tools, such as Microsoft Defender Vulnerability Management or Nessus, and interpreting results for decisionmakers.\nCollection, Curation, and Integration\nHands-on intelligence collection and curation experience, including source assessment and indicator lifecycle management.\nAwareness of organisational, legal, and ethical requirements for specialist intelligence sources in high-assurance environments.\nFamiliarity with structured intelligence sharing integration and security automation concepts.\nExperience progressing actions through case management or ITSM platforms.\nTDR (Threat Detection and Response) Experience\nUnderstanding MITRE ATT&CK, adversary TTPs and common attack vectors.\nExperience detecting, triaging, and investigating cyber security alerts and distinguishing false positives from incidents.\nAbility to create clear incident records and recommend proportionate countermeasures.\nWorking knowledge of cyber security incident response.\nFlexibility to support customer TDR activity during BAU hours when required; this is not the core role.\n7) Behavioral Competencies\nCustomer-focused: calm, credible and diplomatic; support decisions without alarmism.\nClear communicator: adapts complex threats for executive, operational and engineering audiences.\nAnalytical: connects weak signals and anticipates changes in attacker behaviour.\nQuality-driven: evidence-led, consistent, and precise.\nCollaborative: works effectively across intelligence, detection, engineering, vulnerability, and service-management teams.\n8) Desirable (Nice-to-have)\nCTI or VM experience in UK Government, MOD, CNI or another high-assurance environment.\nExperience in multi-tenant or MSSP operations and data-segregation requirements.\nExperience with CTI platforms supporting correlation, analytics, or campaign reconstruction.\nExperience building or using MISP.\nLeidos Sector: OOT\nDepartment: Leidos CSOC\nSecurity Requirement: Eligibility and willingness to obtain SC and DV security clearance are mandatory; no clearance is required on entry.\nOperating Model: 24x7x365 multi-customer CSOC, primarily aligned to an anchor customer.\nWorking Model: BAU Monday to Friday, 37.5 hours per week; not shift work.\nHybrid/Remote/Onsite: Onsite role. Homeworking requests will be considered case by case.\nWhat we do for you:\nAt Leidos we are PASSIONATE about customer success, UNITED as a team and INSPIRED to make a difference. We offer meaningful and engaging careers, a collaborative culture, and support for your career goals, all while nurturing a healthy work-life balance.\nWe provide an employment package that attracts, develops and retains only the best in talent. Our reward scheme includes:\nContributory Pension Scheme\nPrivate Medical Insurance\n33 days Annual Leave (including public and privilege holidays)\nAccess to Flexible benefits (including life assurance, health schemes, gym memberships, annual buy and sell holidays and a cycle to work scheme)\nFlexi-TIme\nCommitment to Diversity:\nWe welcome applications from every part of the community and are committed to a truly diverse and inclusive culture. We foster a sense of belonging, welcoming all perspectives and contributions, and providing equal access to opportunities and resources for everyone. If you have a disability or need any reasonable adjustments during the application and selection stages please let us know, and we will respond in a way that best fits your needs.\nWho We Are:\nLeidos UK & EUROPE - we work to make the world safer, healthier, and more efficient through technology, engineering and science.\nLeidos is a growing company delivering innovative technology and solutions focused on safeguarding critical capabilities and transformation in frontline services, our work in the United Kingdom includes addressing some of the most complex problems in defence, healthcare, government, safety and security, and transportation.\nWhat Makes Us Different:\nPurpose: you can use your passion and abilities at Leidos to keep the people you care about safe. We are at the forefront of machine learning, AI, cyber security and solutions. Using your skills in the technology frontline by helping to build a safer world. You can inspire change.\nCollaboration: having flexibility to do your job is one of our core benefits, enabling you to become part of our extraordinary team. We have been empowering our people to work flexibly for years. Whether you work from home, the office or on customer sites, we will give you the digital tools and the...","description_format":"text","description_chars":13463,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Gym membership","Health insurance"],"hiring_locations":[{"name":"United Kingdom","iso":"GB","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","National Security","C4ISR"],"lifecycle":[{"event":"open","at":"2026-11-08T22:36:42Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":4,"expected_fill_days":28,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/leidos-cyber-threat-intelligence-analyst-2","json_url":"https://alion.io/job/leidos-cyber-threat-intelligence-analyst-2.json","meta":{"generated_at":"2026-11-10T11:02:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25605,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-cyber-threat-intelligence-analyst-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-cyber-threat-intelligence-analyst-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-cyber-threat-intelligence-analyst-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-cyber-threat-intelligence-analyst-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-cyber-threat-intelligence-analyst-2"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3947634}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3947634},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}