{"id":731518,"url":"https://alion.io/job/leidos-tier-3-cyber-threat-intelligence-analyst","title":"Tier 3 Cyber Threat Intelligence Analyst","company":{"id":7791,"name":"Leidos","domain":"leidos.com","url":"https://alion.io/company/leidos","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":78,"open_postings":278,"ghost_share":0.004,"stale_share":0.871,"repost_share":0.011,"time_to_fill_p50_days":28,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States","Chandler, United States","Saint Louis, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":107000,"max_usd":205000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1385},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"Diamond Model","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Splunk","optional":false},{"name":"C++","optional":true},{"name":"Crowdstrike","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"Tanium","optional":true},{"name":"Visual Basic","optional":true},{"name":"Zscaler","optional":true}],"status":"live","first_seen_at":"2026-09-09T00:00:00Z","employer_posted_date":"2026-09-09","last_verified_at":"2026-11-02T11:58:09Z","board_verified":true,"closed_at":null,"days_open":54,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":54},"description":"Leidos is seeking a Tier 3 Cyber Threat Intelligence Analyst to join our team on a highly visible cyber security single-award IDIQ vehicle that provides Network Operations Security Operations (NOSC) support, cyber analysis, and application development.\nDepartment of Homeland Security (DHS), NOSC Support Services is a US Government program responsible to monitor, detect, analyze, mitigate, and respond to cyber threats and adversarial activity on the DHS Enterprise. DHS NOSC has primary responsibility for monitoring and responding to security events and incidents detected at the Trusted Internet Connection (TIC) and Policy Enforcement Point (PEP) and is responsible for directing and coordinating detection and response activities performed by each Component SOC. Direction and coordination are achieved through a shared DHS incident tracking system and other means of coordination and communication.\nThe Cyber Threat Intel Analyst will need a strong cyber security background with experience with the following: Identify, track and investigate high priority threat campaigns, malicious actors with the interest, capability and TTPs (Techniques, Tactics and Procedures).\nBring a comprehensive understanding, analyzing and tracking the cyber threat landscape, including identifying and analyzing cyber threats actors, APT TTPs and/or activities to enhance cybersecurity posture of the organization’s IT operating environment.\nBasic Qualifications\nThe candidate must currently possess a Top Secret/SCI Clearance.\nBS in IT related field and 8-12 years’ experience in an IT field, or MS in IT related field and 8+ years’ experience in an IT Field, with a minimum of 7 years of experience as a Tier III senior cyber security analyst performing intelligence analysis, collection management, and technical analysis.\nTwo years of recent experience with host-based and network-based security monitoring solutions and to include security content recommendation or development (host based and network signatures).\nMaintain and drive the development of new reports of Cyber Threat Intelligence analysis to peers, management and customer teams for purposes of situational awareness and making threat intelligence actionable.\nProvide support to the Network Operations Security Center during incident response and threat hunting activities that include cyber threat analysis support, research, recommending relevant remediation and mitigation.\nConduct trending and correlation of various cyber intelligence sources for the purposes of indicator collection, shifts in TTPs, attribution and establish countermeasures to increase cyber resiliency.\nHost-based and network-based forensics related to the identification of advanced cyber threat activities, intrusion detection, incident response, malware analysis, and security content development (e.g., signatures, rules etc.); and cyber threat intelligence.\nDeep understanding of the cyber \"Pyramid of Pain\", Cyber Kill Chain, MITRE ATT&CK and the Diamond Model. Analysts should be able to conduct in-depth research into threat actors, tools, infrastructure, and TTPs using these frameworks.\nAbility to correlate and enrich data from intelligence sources with internal logs, alerts, and incident data from Splunk and Analyst1 to drive threat hunting and detection initiatives.\nStrong written and oral communication skills.\nPreferred Qualifications\nMust have at least one of the following certifications:\nMust have one of the following certifications: CASP+ CE, CCNP-Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP\nAdditionally preferred certifications held:\nSANS GCTI\nPrevious DOD, IC or Law Enforcement Intelligence or Counterintelligence Training/Experience.\nKnowledge of Structured Analytic Technique\nDeveloping scripts to support cyber threat detection that outputs results in a variety of formats, such as VB scripts, Python, C++, HTML, XML or other types most appropriate for the task.\nProficient in one more of the following computer languages Python, Bash, Visual Basic or PowerShell to support cyber threat detection or reporting.\nWorking familiarity with additional tools such as CrowdStrike Falcon, Tanium, Proofpoint TAP, and Zscaler.\nIf you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.\nOriginal Posting:\nSeptember 9, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.\nPay Range:\nPay Range -The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.","description_format":"text","description_chars":5249,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","National Security","C4ISR"],"lifecycle":[{"event":"open","at":"2026-09-11T09:51:26Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 50 · green card filings: 24","filings_12m":50,"filings_prev_12m":58,"green_card_filings_12m":24,"median_offered_wage_usd":124257,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":4}],"liveness":{"score":18,"band":"cold","label":"Long shot","p_open":1,"p_active":0.503,"p_room":0.36,"age_days":54,"expected_fill_days":28,"reasons":["conf:4","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/leidos-tier-3-cyber-threat-intelligence-analyst","json_url":"https://alion.io/job/leidos-tier-3-cyber-threat-intelligence-analyst.json","meta":{"generated_at":"2026-11-02T12:58:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":17698,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7791},"rest":"https://alion.io/mcp/rest/get_company?id=7791"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fleidos-tier-3-cyber-threat-intelligence-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fleidos-tier-3-cyber-threat-intelligence-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fleidos-tier-3-cyber-threat-intelligence-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/leidos-tier-3-cyber-threat-intelligence-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fleidos-tier-3-cyber-threat-intelligence-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":731518}},{"tool":"search_jobs","arguments":{"company":"leidos.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":731518},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}