Cyber Defense Analyst (2nd Shift)

We need to produce HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We must not repeat job title as heading. Must not include Job ID etc. Must preserve all substantive info, remove boilerplate, navigation, legal, EEO, scam warning, duplicated lines, application instructions. We need to parse the description. Key info: - Title: Cyber Defense Analyst (2nd Shift) (but we don't repeat as heading) - Location: Suitland, MD - Clearance: Active TS/SCI - 2nd Shift Work Hours: 1530 – 2330 - Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs. - Primary Responsibilities: list bullet points. - Required Qualifications: bullet list. - Required Certifications: list. - Pay Range: $87,100.00 - $157,450.00 (with note it's guideline). So we can include Pay section. - Benefits: mention "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." Also earlier "Pay and benefits are fundamental..." but we can include Benefits section with those specifics. - Schedule? We have schedule info: 2nd shift 1530-2330, occasional floater shifts. - About Leidos: maybe not needed as it's boilerplate? It's about company, but could be considered "About the role"? The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have About the role (maybe a brief description of role). The posting includes description: "Leidos is seeking a Cyber Defense Analyst (2nd Shift) to join a mission focused team supporting the Navy's cybersecurity environment at the Office of Naval Intelligence (ONI) Hopper Global Communications Center (HGCC) in Suitland, MD. In this role, you will serve on the front line of cyber defense, helping protect critical TS/SCI networks by monitoring and investigating cybersecurity alerts, identifying potential threats, and supporting proactive threat hunting activities. You will apply your experience in the Certified Network Defender (CND) discipline and knowledge of IT systems and networks to analyze security events, manage incident tickets, support intelligence gathering and analysis, and communicate findings to key stakeholders." That's suitable for About the role. We need to avoid duplication: The responsibilities list also includes similar items; but we can keep both. We must not include boilerplate like "Original Posting September 15, 2026", "For U.S. Positions: While subject to change...", "Pay Range Pay Range $87,100.00 - $157,450.00 The Leidos pay range for this job level is a general guideline only..." We need to keep the pay range info but can summarize? The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. So we need to keep the exact pay range and note that it's a guideline? The note is part of the posting; it's substantive? It says "The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary." That's substantive. We should keep it. Similarly benefits: "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits." We can keep that. Schedule: "Work Location Hours: This is a 2nd shift position with regular work hours of 1530 – 2330. Occasional floater shifts or coverage outside of these hours may be required based on program and staffing needs." We need to avoid duplication: The location and clearance maybe could be in About the role or a separate meta? But we only have allowed headings. Could include location and clearance in About the role paragraph. We must not include Job ID/requisition numbers. We must not include cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to cut out the "Securing Your Data", "Commitment to Non-Discrimination", etc. Also need to cut out "About Leidos" paragraph (maybe considered boilerplate). It's about the company, not role-specific. Could be considered not needed. The instruction: Prefer a few substantive sections over many thin ones. So we could omit About Leidos. We need to include Skills section? The posting includes many skills: experience with SIEM, NIDPS, host-based tools, scripting languages, penetration testing, ticketing systems, report writing, intelligence gathering, analytical skills. Those could go under Skills or Requirements. We have both Requirements and Qualifications headings. The posting has "Required Qualifications" (education/experience/clearance) and then a list of experience/knowledge. Could treat "Required Qualifications" as Qualifications section, and "Required Certifications" as Certifications maybe under Skills? But we have Skills heading allowed. Could put technical skills under Skills. We need to decide sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not create empty sections. So we need to see if we have content for each. - About the role: yes. - Responsibilities: yes (list). - Requirements: maybe we can put education/experience/clearance under Requirements. Or we could put under Qualifications. The posting has "Required Qualifications" heading with bullet list. So we can map that to Qualifications section. Then Requirements could be something else? Could be "Required Certifications"? But we have Skills heading for technical skills. Could put certifications under Skills? Or maybe we create a Certifications section but not in allowed list; we must only use those headings. So we need to fit certifications somewhere: maybe under Skills (as they are certifications). Or under Qualifications (as they are required). The instruction: Use headings as examples; we can use those headings but not limited? It says "Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." The e.g. suggests those are examples; we could also use other headings? But better to stick to those. We can put certifications under Skills (as they are qualifications). Or we could put under Requirements (as they are required). I'd put under Skills: list of certifications. - Skills: we can list technical skills: SIEM, NIDPS, host-based tools, scripting languages, penetration testing tools, ticketing systems, report writing, intelligence gathering, analytical skills. - Benefits: we have benefits description. - Pay: we have pay range and note. - Schedule: we have shift hours. We must avoid duplication: Ensure we don't repeat same info in multiple sections. Let's draft. First, About the role paragraph: combine location, clearance, mission, role description. We'll write:

About the role

Leidos is seeking a Cyber Defense Analyst (2nd Shift) to join a mission-focused team supporting the Navy's cybersecurity environment at the Office of Naval Intelligence (ONI) Hopper Global Communications Center (HGCC) in Suitland, MD. The position requires an active TS/SCI clearance and involves serving on the front line of cyber defense, monitoring and investigating cybersecurity alerts on TS/SCI networks (including JWICS, ATLAS), identifying potential threats, supporting proactive threat hunting, analyzing security events, managing incident tickets, supporting intelligence gathering and analysis, and communicating findings to key stakeholders.

That captures location, clearance, role. Now Responsibilities: list bullet points from Primary Responsibilities. We need to capture each bullet: - Perform first line monitoring of security tools and conduct initial analysis of alerts for TS/SCI networks, including JWICS, ATLAS, and other networks for which HGCC is responsible. - Monitor organizational cybersecurity tools for alerts, anomalies, and indicators of compromise. - Investigate and perform initial technical analysis of cybersecurity alerts and events, escalating potential incidents to Tier 2 as appropriate. - Create, update, and manage incident and event tickets within the approved ticketing system. - Conduct proactive threat hunting activities to identify potential malicious activity and emerging threats. - Perform wireless security scans of facilities and document and report findings. - Correlate alerts and security events across multiple platforms to identify patterns, trends, and potential threats. - Prepare and deliver operational and situational awareness briefings. - Support annual cyber defense exercises. We'll put in

• . Now Qualifications: from Required Qualifications bullet list: - Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired with 4+ years of experience or Master’s degree with 2+ years of experience. Additional experience may be considered in lieu of a degree. - Active TS/SCI security clearance. - Concentrated experience in the CND discipline, regardless of degree. - Experience monitoring and investigating alerts from cybersecurity tools. - Experience with Security Information and Event Management (SIEM) systems such as Splunk and Elastic. - Experience with Network Intrusion Detection/Prevention Systems (NIDPS), such as Cisco FirePower and Palo Alto NGFW, as well as host-based tools such as Trellix ePO, Microsoft Defender, and Tanium. - Knowledge of scripting and coding languages such as Python, Perl, Ruby, JavaScript, PowerShell, C, C++, and Java. - Knowledge of penetration testing and red team tactics, techniques, and procedures, as well as tools such as Kali, SamuraiWTF, Nmap, Burp Suite, sqlmap, and Metasploit. - Knowledge of ticketing systems, report writing, and intelligence gathering, analysis, and dissemination techniques specific to cybersecurity. - Strong analytical, conceptual, and problem-solving skills. We could split some of these into Skills section, but we already have Skills heading. To avoid duplication, we could put the experience/knowledge items under Skills, and keep Qualifications for education/experience/clearance/CND concentration. But the instruction says preserve ALL substantive information; we can distribute but not duplicate. Let's decide: Qualifications section: education/experience/clearance/CND concentration. Skills section: technical skills (SIEM, NIDPS, host-based, scripting languages, penetration testing tools, ticketing systems, report writing, intelligence gathering, analytical skills). Also certifications. But we also have Required Certifications list: Must possess one of the following certifications or obtain one within 30 days of accepting an offer: CompTIA CySA+, CompTIA PenTest+, CompTIA Cloud+, EC Council CEH, GIAC GCIA, GIAC GCIH, GICSP, or Cisco CyberOps. NITESONI DABAOPP1 (looks like a code? maybe ignore). We'll include certifications under Skills or maybe under Qualifications. I'd put under Skills as "Required Certifications". Thus: Qualifications: - Bachelor's degree in Cybersecurity, Information Technology, Information Assurance, or a related area of study desired with 4+ years of experience or Master’s degree with 2+ years of experience. Additional experience may be considered in lieu of a degree. - Active TS/SCI security clearance. - Concentrated experience in the Certified Network Defender (CND) discipline. Skills: - Experience monitoring and investigating alerts from cybersecurity tools. - Experience with SIEM systems such as Splunk and Elastic. - Experience with Network Intrusion Detection/Prevention Systems (NIDPS) such as Cisco FirePower and Palo Alto NGFW, and host-based tools such as Trellix ePO, Microsoft Defender, and Tanium. - Knowledge of scripting and coding languages: Python, Perl, Ruby, JavaScript, PowerShell, C, C++, Java. - Knowledge of penetration testing and red team tactics, techniques, and procedures, and tools such as Kali