Leidos’ Digital Sector is seeking an experienced, multidisciplinary Cyber Threat Intelligence & SOAR Automation Analyst supporting DISA Global. This hybrid technical role bridges day-to-day Cyber Threat Intelligence (CTI) automation with operational Security Orchestration, Automation, and Response (SOAR) solutions development.
In this role, you will perform hands-on threat intelligence analysis, feed curation, and indicator lifecycle management within Threat Intelligence Platforms (TIP), while directly designing, building, and deploying automations in SOAR environments. You will operationalize intelligence feeds by applying low-regret scoring models and building automated defensive workflows to enable real-time blocking, enrichment, and triage across the DoWIN security stacks.
Primary Responsibilities
- Hands-on Intelligence Analysis & Feed Curation: Analyze threat intelligence reporting, assess emerging threats, map adversary tactics to the MITRE ATT&CK framework, and evaluate indicators across diverse external and internal feeds.
- DISA TIP Administration & Indicator Lifecycle Management: Configure, maintain, and optimize DTIP feed ingestion pipelines (STIX/TAXII), manage IOC repositories, maintain data dictionaries, and tune indicator expiration policies.
- Automated Defensive Blocking & Sensor Integration: Implement low-regret scoring logic and automated blocklist distribution for security solutions.
- API Development & Custom Connectors: Write robust Python scripts and utilize REST APIs to interconnect DTIP, Tines, ticketing systems, and SIEM/log repositories.
- Investigation & Operational Triage Support: Support Cyber Security Watch Officers (CSWOs) with indicator validation, false-positive troubleshooting, and rapid-response containment workflows.
- SOAR Playbook Development & Execution: Design, build, test, and optimize automated incident response and threat-enrichment playbooks within Tines to streamline 24x7 SOC monitoring workflows.
- Platform Maintenance & Sustainment: Assist in sustaining and securing core automation and intelligence platforms, maintaining containerized services (Docker), applying STIG configurations, and leveraging Git for version control.
- Technical Intelligence Reporting: Produce technical intelligence briefs, indicator documentation, and triage summaries to inform ongoing defensive operations.
Basic Qualifications
- Clearance: Active Top Secret / Sensitive Compartmented Information (TS/SCI)
- Education & Experience: Bachelor’s in Computer Science, Cybersecurity, IT, or a related discipline plus 4+ years of relevant hands-on operational experience.
- Threat Intelligence Platform (TIP) Experience: experience working with TIP managing IOC lifecycles and configuring threat feed ingestions.
- SOAR & Playbook Development: Proven hands-on experience designing and implementing automated workflows and playbooks using SOAR platforms.
- Scripting & Tooling: Strong scripting skills in Python for API interactions and data parsing, with supplemental experience in Bash or PowerShell.
- Data Formats & Version Control: Proven ability to create, edit, and validate configuration files and schemas in JSON, YAML, and Git for code management.
- Enterprise Security Stacks: Applied technical understanding of enterprise security solutions and their integration mechanisms.
- DoD Compliance: Must possess an active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level baseline certification (e.g., Security+ CE, PenTest+, CySA+, GSEC, or GMON).
Preferred Qualifications
- Low-Regret Triage & IACD: Applied experience utilizing Integrated Adaptive Cyber Defense (IACD) low-regret scoring principles to automate indicator blocking with minimal mission impact.
- Cyber Intelligence Communication Standards: Practical experience parsing and structuring STIX/TAXII intelligence feeds and maintaining CTI data dictionaries.
- Adversary Analysis: Deep understanding of adversary TTPs and practical experience conducting adversary assessment via MITRE ATT&CK.
- SIEM & Big Data: Familiarity querying and integrating workflows with log management and SIEM platforms such as Splunk or Elastic (ELK).
- Zero Trust: Baseline understanding of Zero Trust Architecture (ZTA) concepts and principles.
- Additional Experience: Any experience with ThreatQ TIP and/or Tines
If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.
Original Posting:October 7, 2026For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.
The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.
Skills Required
- Active Top Secret / Sensitive Compartmented Information (TS/SCI) clearance
- Bachelor's degree in Computer Science, Cybersecurity, IT, or a related discipline
- At least 4 years of relevant hands-on operational experience
- Experience working with Threat Intelligence Platforms, including IOC lifecycle management and threat feed ingestion
- Hands-on experience designing and implementing automated workflows and playbooks using SOAR platforms
- Strong Python scripting skills for API interactions and data parsing
- Supplemental experience with Bash or PowerShell
- Ability to create, edit, and validate JSON and YAML configuration files and schemas
- Experience using Git for code management
- Technical understanding of enterprise security solutions and integration mechanisms
- Active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 intermediate-level baseline certification, such as Security+ CE, PenTest+, CySA+, GSEC, or GMON
- Experience applying Integrated Adaptive Cyber Defense low-regret scoring principles
- Experience parsing and structuring STIX/TAXII intelligence feeds and maintaining CTI data dictionaries
- Understanding of adversary tactics, techniques, and procedures and experience using MITRE ATT&CK
- Familiarity integrating workflows with Splunk or Elastic ELK SIEM platforms
- Understanding of Zero Trust Architecture concepts and principles
- Experience with ThreatQ and/or Tines
Leidos Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Leidos and has not been reviewed or approved by Leidos.
-
Healthcare Strength — Healthcare coverage is described as comprehensive, with multiple plan options, low office-visit copays in some plans, and access to mental health and wellness support tools. The availability of HSA/FSA options and employer contributions is positioned as a meaningful part of the total package.
-
Retirement Support — Retirement benefits are framed as a strong component of total rewards, highlighted by a 401(k) match and immediate vesting in the standard package. The Employee Stock Purchase Plan is also presented as an additional long-term wealth-building feature.
-
Wellbeing & Lifestyle Benefits — Wellbeing and lifestyle supports extend beyond core insurance, including wellness programs, fitness-related stipends, and assistance resources. Work flexibility and related perks are also included as part of the broader rewards experience.
Leidos Insights
What We Do
We Are Leidos For 50 years we have been tackling some of the biggest problems that face our nation and our world. OUR MISSION Through our culture of innovation and history of performance, we develop deep customer trust built on integrity and create enduring solutions that improve our world. Leidos is a science and technology solutions leader working to address some of the world’s toughest challenges in the defense, intelligence, homeland security, civil, and healthcare markets. The company’s 43,000 employees support vital missions for government and commercial customers. Headquartered in Reston, Va., Leidos reported annual revenues of approximately $11.09 billion for the fiscal year ended January 3, 2020. Leidos was cited for the meaningful work employees perform that is challenging, impactful, and aligned with our customers’ missions as reasons professionals want to work and stay at our company. Leidos has also been named to lists including Forbes’ Best Employers for Diversity, Forbes’ America’s Best Employers for Women, Military Times Best for Vets Employers, and Ethisphere Institute’s World's Most Ethical Companies®. Employees enjoy career enrichment opportunities available through mobility and development and experience rewarding relationships with supportive supervisors and talented colleagues and customers. Employees appreciate our flexible work environment, allowing for and encouraging a true work-life balance. Our professionals are also excited about our Employee Resource Groups, like the newly launched Collaborative Outreach with Remote and Embedded Employees (CORE), which strives to create an environment where every employee, regardless of location, feels fully engaged as a valued employee of Leidos. Your most important work is ahead.
