cyber intelligence analyst

Booz Allen Hamilton

<div>Cyber Threat Intelligence Analyst<p><b>
The Opportunity</b><b>:</b></p><p>
We are seeking an experienced Cyber Threat Intelligence Analyst to join our Security Operations Center (SOC) team. This role supports analysis and research on latest advanced cyber threats to provide actionable threat intelligence that includes adversary indicators of compromise (IOCs), Techniques, Tactics, and Procedures (TTPs), behaviors, and trends to help defend the client agency. You will conduct analysis to profile threat actor TTPs used to infiltrate networks, systems, and assets to produce threat actor cards, profiles, or threat briefs. You&rsquo;ll report on current and emerging threats that will exploit vulnerabilities and details of the vulnerabilities to stakeholders.</p><p></p><p>
You will collect, analyze, and correlate cyber threat intelligence from open-source, commercial, and government sources. You&rsquo;ll actively monitor open-source intelligence, industry reports, and internal security logs to gather threat information, then synthesize and disseminate critical insights to relevant stakeholders. You&rsquo;ll conduct tactical, operational, and strategic threat analysis in support of ongoing monitoring and investigations, identify patterns, and attribute attacks to specific actors. You will track threat actors, phishing campaigns, malware, and TTPs relevant to the agency&rsquo;s mission and technology footprint. You&rsquo;ll produce actionable reports, briefings, and indicators of compromise (IOCs) for internal stakeholders and support development of new detection rules and analytics based on evolving threats.<br>
<br>
Cyber threats are evolving. Booz Allen is committed to creating an environment where you not only keep pace with the industry, but propel it forward. With access to academic programs, certifications, and opportunities to use expert tradecraft, we&rsquo;ll continuously invest in you so you can create the career you want as you grow.</p><p></p><p>
Join us. The world can&rsquo;t wait.<br>
<br>
<b>You Have:</b></p><ul><li><p>
Experience as a cyber threat analyst collaborating with multiple internal and external stakeholders to gather data and intelligence, analyze, vet, and enrich the intelligence, create joint reports, and share with stakeholders</p></li><li><p>
Experience using intelligence platforms such as MISP Threat Intelligence Platform</p></li><li><p>
Knowledge of CNE and CNA tools and tradecraft along with signatures and Tactics, Techniques, and Procedures (TTPs) associated with preparation for and execution or implementation of such attacks</p></li><li><p>
Knowledge of cyber threats, open-source research, nation state actors, vulnerabilities, and cyber attacks</p></li><li><p>
Ability to prioritize and juggle multiple events or initiatives simultaneously</p></li><li><p>
Top Secret clearance</p></li><li><p>
Bachelor&rsquo;s degree and 15+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role, or 19+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role in lieu of a degree</p></li></ul><p></p><p><b>
Nice If You Have:</b></p><ul><li><p>
Experience working in a SOC or cyber operations environment</p></li><li><p>
Experience working with Splunk, including writing or understanding queries and evaluating telemetry logs</p></li><li><p>
Knowledge of current and emerging cyber adversaries and their Techniques, Tactics, and Procedures (TTPs)</p></li><li><p>
Knowledge of threat modeling and adversary tactics and techniques frameworks such as MITRE ATT&amp;CK matrices, Cyber Kill Chain, STRIDE, or PASTA</p></li><li><p>
Knowledge of Confluence and Jira</p></li><li><p>
Knowledge of ServiceNow or similar ticketing systems</p></li><li><p>
Ability to write and deliver succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences</p></li><li><p>
CISSP, GCTI, GCIA, GCIH, CEH, CTIA, or equivalent Certification</p></li></ul><p></p><p><b>
Clearance:</b><br>
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Top Secret clearance is required.</p><p></p><p><b>
Compensation</b></p><p>
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.</p><p></p>
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.<p></p><p><b>
Identity Statement</b></p><p>
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.</p><p></p><p><b>
Candidate AI Usage Policy</b></p><p>
AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on <b>your </b>own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited <b>unless permission is explicitly provided</b>.
</p><p></p><p><b>Work Model</b><br>
Our people-first culture prioritizes the benefits of collaboration, whether it occurs in person or virtually. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.</p><ul><li><p><b>
Remote</b>: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.</p></li><li><p><b>
Hybrid</b>: If this position is listed as hybrid, you will be expected to work from a Booz Allen facility frequently, in alignment with leadership expectations and the needs of the role. You may also be required to work from or visit a customer facility.</p></li><li><p><b>
Onsite</b>: If this position is listed as onsite, work will primarily be performed at a Booz Allen office or customer facility, where employees will collaborate directly with colleagues and customers as required by the role.</p></li></ul><p></p><p><b>
Commitment to Non-Discrimination</b></p><p>
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</p></div><p></p>

Cyber Threat Intelligence Analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

Eli Lilly

<div><p>At Lilly, we unite caring with discovery to make life better for people around the world. We are a global healthcare leader headquartered in Indianapolis, Indiana. Our employees around the world work to discover and bring life-changing medicines to those who need them, improve the understanding and management of disease, and give back to our communities through philanthropy and volunteerism. We give our best effort to our work, and we put people first. We&rsquo;re looking for people who are determined to make life better for people around the world.</p><p></p><p>
The Cyber Threat Intelligence (CTI) Lead Analyst leads one of the eight functional teams within Global Cyber Defense Operations (GCDO). The role directs the strategy, operations, and continued maturation of Lilly's Cyber Threat Intelligence function &mdash; covering threat actor tracking and attribution, brand and executive protection, intelligence sharing collaborators, and the integration of intelligence into detection, response, and proactive defense across GCDO.</p><p></p><p>
This is a player/coach role. The CTI Lead Analyst is expected to maintain personal technical depth in threat analysis and set the example of the standard on the hardest analytical work, while simultaneously shaping the strategy of the function, developing the analyst team, and representing GCDO across multi-functional and external forums. Candidates should expect to spend their time across both the technical and strategic dimensions of the role rather than choosing one.</p><p></p><p><b>
What You Will Do:</b></p><ul><li><p><b>
Function Strategy and Maturation: </b>Lead the continued development and maturation of the Cyber Threat Intelligence function, advancing it from intelligence consumer to intelligence producer and contributor across the pharmaceutical industry and the broader cyber community.</p></li><li><p><b>
Hands-on Technical Leadership (Player/Coach): </b>Maintain personal technical proficiency in threat analysis, attribution, and intelligence tradecraft. Be the example on complex analytical work, set the technical bar for the team, and remain credible at the keyboard while developing analyst capability.</p></li><li><p><b>
Threat Actor Tracking and Attribution: </b>Direct the threat actor tracking and attribution program as a multi-functional Cybersecurity capability &mdash; championing adoption across response, detection, architecture, platforms, threat mitigation, identity, and other defensive functions, while remaining accountable for the program's outputs, methodology, and long-term maturation. Maintain alignment between internally tracked activity clusters and industry-recognized threat actor designations to support shared understanding across the security community. Ensure the program produces actionable intelligence that informs detection, response, and strategic decisions across the enterprise.</p></li><li><p><b>
Brand and Executive Protection: </b>Lead the cyber threat intelligence components of brand and executive protection, in close coordination with Corporate Security, Legal, the Brand Office, and other partners. Drive multi-functional governance to reduce duplication and improve coverage across protective monitoring services.</p></li><li><p><b>
Partner Collaboration: </b>Develop and maintain strong working relationships with key partners across Cybersecurity, Corporate Security, HR, Legal, the Brand Office, Ethics &amp; Compliance, and Tech@Lilly. Represent GCDO and the CTI function in multi-functional forums where intelligence drives prioritization.</p></li><li><p><b>
Intelligence Sharing and Industry Engagement: </b>Strengthen Lilly's role as an active contributor in pharmaceutical-sector and cross-industry intelligence sharing communities. Direct analyst engagement in intelligence sharing collaborators and ensure Lilly contributes high-value research at a cadence consistent with peer organizations.</p></li><li><p><b>
Team Leadership and Development: Lead a team</b> of cyber threat intelligence analysts. Provide direction, mentorship, and structured development. Build a high-performing team with clear succession depth across analyst tradecraft, brand protection, and strategic intelligence.</p></li><li><p><b>
Tooling and Capability Enhancement: </b>Direct the evaluation, introduction, and integration of capabilities supporting the CTI mission. Ensure intelligence is operationalized into automated enrichment, detection, and response workflows across the GCDO toolchain.</p></li><li><p><b>
Incident Response Support: </b>Provide intelligence-driven support to incident response investigations, particularly for sophisticated and targeted activity. Ensure CTI insights inform the full response lifecycle from triage through after-action review.</p></li><li><p><b>
Training, Awareness, and Communication: </b>Develop and deliver training and awareness programs that improve the organization's understanding of the external threat landscape. Communicate intelligence findings in formats appropriate for technical analysts, operational leaders, and senior leaders.</p></li></ul><p></p><p><b>
Your Minimum Basic Qualifications</b></p><ul><li><p>
HS Diploma/GED required</p></li><li><p>
7+ years of shown experience in Cybersecurity, including hands on cyber threat intelligence work</p></li><li><p><b>
Demonstrated experience materially contributing to threat actor tracking, attribution, and analytical methods that directly inform defensive decisions.</b></p></li><li><p><b>
Evidence of skills in areas e.g., malware analysis and/or reverse engineering, and campaign tracking to understand adversary objectives, techniques, and patterns.
</b></p></li><li><p><b><i>Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.</i></b></p></li></ul><p><b>
Additional Skills / Preferences</b></p><ul><li><p>
Proven ability to operate as a player/coach &mdash; maintaining technical depth while leading a team and shaping strategy</p></li><li><p>
Strong analytical and problem-solving skills, with a track record of producing intelligence that drives decisions</p></li><li><p>
Experience leading or significantly contributing to a threat actor tracking, attribution, or intelligence analysis program</p></li><li><p>
Experience working across brand protection, executive protection, or related multi-functional domains is preferred</p></li><li><p>
Clear and confident communicator, with the ability to translate technical intelligence for technical, operational, and executive audiences</p></li><li><p>
Ability to work independently and lead through influence across organizational boundaries</p></li><li><p>
High level of integrity and ethical standards; awareness of laws, regulations, policies, and ethics as they relate to cybersecurity, privacy, and intelligence work</p></li><li><p>
Relevant certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA)</p></li></ul><p><b>
Additional Information</b></p><p>
Due to the global nature of this position, some international travel may be required.</p><p>
This position may be filled with a remote worker. Remote workers may be asked to travel based on business needs, which would require discussion and approval from the employee's supervisor.</p><p>
Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.</p><p></p><p>
Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status.</p><p><br>
Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia Network, Black Employees at Lilly, Chinese Culture Network, Japanese International Leadership Network (JILN), Lilly India Network, Organization of Latinx at Lilly (OLA), PRIDE (LGBTQ+ Allies), Veterans Leadership Network (VLN), Women&rsquo;s Initiative for Leading at Lilly (WILL), enAble (for people with disabilities). Learn more about all of our groups.</p><p></p><p>
Actual compensation will depend on a candidate&rsquo;s education, experience, skills, and geographic location. The anticipated wage for this position is</p>
$162,000 - $268,400<p></p><p>
Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly&rsquo;s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.</p><p></p><p>
#WeAreLilly</p></div>

Cyber Threat Intelligence - Lead Analyst

The Amatriot Group

<div><div>Cyber Threat Analyst<br>
5 Year DoJ Contract | Chantilly, VA<br>
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in<br>
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in<br>
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion<br>
investigation, host-based forensic analysis, network traffic analysis, and attribution support<br>
within a highly sensitive operational environment. The ideal candidate will possess experience<br>
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard<br>
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and<br>
support investigative operations.<br>
Responsibilities<br>
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations.<br>
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments.<br>
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and<br>
unauthorized access.<br>
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of<br>
compromise.<br>
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative<br>
lead generation.<br>
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence.<br>
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes.<br>
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies.<br>
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and<br>
procedures (TTPs).<br>
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations.<br>
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders.<br>
Required Skills &amp; Experience<br>
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph.<br>
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered<br>
in lieu of years of experience<br>
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk<br>
o EnCase<br>
o Magnet AXIOM<br>
o X-Ways Forensics<br>
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis.<br>
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

<div>
 5 Year DoJ Contract | Chantilly, VA
 <br/>
 <br/>
 Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in
 <br/>
 <br/>
 analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in
 <br/>
 <br/>
 support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion
 <br/>
 <br/>
 investigation, host-based forensic analysis, network traffic analysis, and attribution support
 <br/>
 <br/>
 within a highly sensitive operational environment. The ideal candidate will possess experience
 <br/>
 <br/>
 analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard
 <br/>
 <br/>
 forensic and cyber analysis tools to identify malicious activity, recover artifacts, and
 <br/>
 <br/>
 support investigative operations.
 <br/>
 <br/>
 <strong>
  Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Process, evaluate, and analyze digital network communications and cyber threat data to
   <br/>
   <br/>
  </li>
 </ul>
 identify malicious activity and support investigative operations.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and
   <br/>
   <br/>
  </li>
 </ul>
 network environments.
 <br/>
 <br/>
 <ul>
  <li>
   Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets
   <br/>
   <br/>
  </li>
 </ul>
 to identify indicators of compromise, attacker activity, persistence mechanisms, and
 <br/>
 <br/>
 unauthorized access.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,
   <br/>
   <br/>
  </li>
 </ul>
 software usage, command execution, credential activity, and network-based indicators of
 <br/>
 <br/>
 compromise.
 <br/>
 <br/>
 <ul>
  <li>
   Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,
   <br/>
   <br/>
  </li>
 </ul>
 and user activity across multiple data sources to support attribution and investigative
 <br/>
 <br/>
 lead generation.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline
   <br/>
   <br/>
  </li>
 </ul>
 execution, and other system-level forensic evidence.
 <br/>
 <br/>
 <ul>
  <li>
   Draft detailed technical reports and analytical findings based on cyber investigations
   <br/>
   <br/>
  </li>
 </ul>
 while participating in internal review and quality assurance processes.
 <br/>
 <br/>
 <ul>
  <li>
   Support development and refinement of cyber analysis processes, CONOPS, SOPs,
   <br/>
   <br/>
  </li>
 </ul>
 and investigative methodologies.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct open-source and intelligence community research to maintain awareness of
   <br/>
   <br/>
  </li>
 </ul>
 emerging cyber threats, malware trends, and adversary tactics, techniques, and
 <br/>
 <br/>
 procedures (TTPs).
 <br/>
 <br/>
 <ul>
  <li>
   Collaborate with internal teams and mission partners across the intelligence community
   <br/>
   <br/>
  </li>
 </ul>
 to support tactical and strategic cyber operations.
 <br/>
 <br/>
 <ul>
  <li>
   Provide operational updates and analytical findings to leadership and investigative
   <br/>
   <br/>
  </li>
 </ul>
 stakeholders.
 <br/>
 <br/>
 <strong>
  Required Skills &amp; Experience
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Active Top Secret Clearance required, with willingness and ability to obtain a Counter
   <br/>
   <br/>
  </li>
 </ul>
 Intelligence (CI) Polygraph.
 <br/>
 <br/>
 <ul>
  <li>
   BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced
   <br/>
   <br/>
  </li>
 </ul>
 certifications, specialized training, or equivalent hands-on experience may be considered
 <br/>
 <br/>
 in lieu of years of experience
 <br/>
 <br/>
 <ul>
  <li>
   Experience performing host-based forensic analysis utilizing Splunk.
  </li>
  <li>
   Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.
  </li>
  <li>
   Hands-on experience with industry-standard forensic tools such as:
  </li>
  <li>
   Splunk
  </li>
  <li>
   EnCase
  </li>
  <li>
   Magnet AXIOM
  </li>
  <li>
   X-Ways Forensics
  </li>
  <li>
   Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,
   <br/>
   <br/>
  </li>
 </ul>
 and forensic artifact analysis.
 <br/>
 <br/>
 <ul>
  <li>
   Experience correlating threat indicators and investigative data to support attribution and
   <br/>
   <br/>
  </li>
 </ul>
 operational analysis.
</div>


General Dynamics Information Technology

<p></p><div><div><div><p>Your Impact</p><p>
Own your opportunity to serve as a critical component of our nation&rsquo;s safety and security. Make an impact by using your expertise to protect our country from threats.</p><p>
Job Description</p><div><div>
SOC ANALYST<br>
<br>
Advance your career while impacting our national security in cyber as a SOC Analyst Principal at GDIT. Here, technologists have many paths to grow a meaningful career supporting cyber missions and operations across the federal government.<br>
<br>
WHAT YOU&rsquo;LL NEED TO SUCCEED<br>
Bring your cyber expertise and drive for innovation to GDIT. The SOC Analyst Principal must have:<br>
<ul><li>Education: Technical Training, Certification(s) or Degree</li><li>Experience: 4+ years of related experience</li></ul></div><p></p><p>
Required certs:</p><p>
IAT II</p><p>
CSSP Analyst</p><p>
GMON</p><p>
SCCU</p><div><br>
GDIT IS YOUR PLACE<br>
At GDIT, the mission is our purpose, and our people are at the center of everything we do.<br>
<ul><li>Growth: AI-powered career tool that identifies career steps and learning opportunities</li><li>Support: An internal mobility team focused on helping you achieve your career goals</li><li>Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off</li><li>Community: Award-winning culture of innovation and a military-friendly workplace</li></ul><br>
OWN YOUR OPPORTUNITY<br>
Explore a career in cyber at GDIT and you&rsquo;ll find endless opportunities to grow alongside colleagues who share your focus on defending and protecting what matters.</div><p></p><p>
#VA_2026Alumni
</p><p></p><p>#MD_2026Alumni</p>
</div></div><div><div><div><p>Work Requirements</p></div></div><div></div><div><div>
Years of Experience<div>
8 + years of related experience</div><ul><li>may vary based on technical training, certification(s), <i>or</i> degree</li></ul></div><div></div><div>
Certification</div><p></p><div>
Travel Required<div>
Less than 10%</div></div><div></div><div>
Citizenship<div>
U.S. Citizenship Required</div></div></div></div></div><div><p>
Salary and Benefit Information</p><div>
The likely salary range for this position is $110,500 - $149,500. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.<br>
View information about benefits and our total rewards program.</div><p>
About Our Work</p><div>
We are GDIT. A global technology and professional services company that delivers technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across over 50 countries worldwide, offering leading capabilities in digital modernization, AI/ML, cloud, cyber and application development. Together with our customers, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.</div><div>
Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc.</div><div><i>
Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans</i></div></div></div>

Cyber SOC Incident Detector (MIDS Shift) - TS/SCI with Polygraph

<p></p><div><div><div><p>Your Impact</p><p>
Own your opportunity to serve as a critical component of our nation&rsquo;s safety and security. Make an impact by using your expertise to protect our country from threats.</p><p>
Job Description</p><div><p>
SOC ANALYST</p><div>
swings: 1400-2200<br>
<br>
Advance your career while impacting our national security in cyber as a SOC Analyst Principal at GDIT. Here, technologists have many paths to grow a meaningful career supporting cyber missions and operations across the federal government.<br>
<br>
WHAT YOU&rsquo;LL NEED TO SUCCEED<br>
Bring your cyber expertise and drive for innovation to GDIT. The SOC Analyst Principal must have:<br>
<ul><li>Education: Technical Training, Certification(s) or Degree</li><li>Experience: 4+ years of related experience</li></ul></div><p></p><p>
Required certs:</p><p>
IAT II</p><p>
CSSP Analyst</p><p>
GMON</p><p>
SCCU</p><div><br>
GDIT IS YOUR PLACE<br>
At GDIT, the mission is our purpose, and our people are at the center of everything we do.<br>
<ul><li>Growth: AI-powered career tool that identifies career steps and learning opportunities</li><li>Support: An internal mobility team focused on helping you achieve your career goals</li><li>Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off</li><li>Community: Award-winning culture of innovation and a military-friendly workplace</li></ul><br>
OWN YOUR OPPORTUNITY<br>
Explore a career in cyber at GDIT and you&rsquo;ll find endless opportunities to grow alongside colleagues who share your focus on defending and protecting what matters.</div><p></p><p>
#VA_2026Alumni
</p><p></p><p>#MD_2026Alumni</p>
</div></div><div><div><div><p>Work Requirements</p></div></div><div></div><div><div>
Years of Experience<div>
8 + years of related experience</div><ul><li>may vary based on technical training, certification(s), <i>or</i> degree</li></ul></div><div></div><div>
Certification</div><p></p><div>
Travel Required<div>
Less than 10%</div></div><div></div><div>
Citizenship<div>
U.S. Citizenship Required</div></div></div></div></div><div><p>
Salary and Benefit Information</p><div>
The likely salary range for this position is $110,500 - $149,500. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.<br>
View information about benefits and our total rewards program.</div><p>
About Our Work</p><div>
We are GDIT. A global technology and professional services company that delivers technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across over 50 countries worldwide, offering leading capabilities in digital modernization, AI/ML, cloud, cyber and application development. Together with our customers, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology.</div><div>
Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc.</div><div><i>
Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans</i></div></div></div>

Cyber SOC Incident Detector (Swing Shift) - TS/SCI with Polygraph

Search 4971+ Cyber intelligence analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

4971 cyber intelligence analyst jobs Near Me

Cyber Threat Intelligence Analyst

SBA - Cyber Threat Intelligence Analyst

Cyber Threat Intelligence - Lead Analyst

Cyber Threat Analyst

Cyber Threat Analyst

Cyber SOC Incident Detector (MIDS Shift) - TS/SCI with Polygraph

Cyber SOC Incident Detector (Swing Shift) - TS/SCI with Polygraph