Cyber Fusion Analyst
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive information, remove boilerplate (cookie/navigation/legal/EEO etc). Remove duplicated lines, application instructions. Also remove "Job ID / requisition numbers". Not present.
We need to include sections only when posting has real specific content.
We need to output only HTML fragment, no /, no markdown fences.
Let's extract content:
- Description: "We have a job opportunity for a Cyber Intelligence Fusion Analyst on the DISA GSM-O Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports the Security Operations Center (SOC) Fusion mission at the Mark Center, Alexandria, Virginia. The team operates 100% onsite at the Mark Center during normal business hours, Monday through Friday, 0600–1800."
- Position Summary: paragraph.
- Primary Responsibilities: list of bullet points.
- Required Qualifications: list.
- Preferred Qualifications: list.
- Pay And Benefits: paragraph with pay range and benefits list.
- Workplace Type: "This is a fully onsite position in Alexandria,VA." (duplicate of schedule maybe). Could combine with schedule.
- Application Deadline: "This position is anticipated to close on Sep 28, 2026." Might be considered metadata; but it's not boilerplate? It's a date; we could include maybe in a short p under a heading like "Application Timeline"? But instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Application deadline is minor metadata; we could fold into a short p maybe under a heading? But we should avoid creating a section for minor metadata unless we have real specific content. Could include a
after description maybe.
- About TEKsystems: boilerplate about company, equal opportunity, etc. Should be removed as boilerplate/legal/EEO. So drop.
- San Francisco Fair Chance Ordinance etc: legal boilerplate, drop.
- Use of Artificial Intelligence (AI): also boilerplate, drop.
Thus final sections: About the role? Could use "About the role" heading for description and position summary? But we already have description and position summary; we could combine into a section "About the role". Or we could have separate sections: "Position Summary" and "Responsibilities". The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can use those headings.
We need to decide which sections to include:
- About the role: could contain description and position summary.
- Responsibilities: list of primary responsibilities.
- Requirements: could contain Required Qualifications.
- Qualifications: maybe Preferred Qualifications? Or Skills? The instruction list includes Skills as possible heading. We could put Preferred Qualifications under "Skills" or "Qualifications". But we already have Required Qualifications; we could have "Requirements" for required, and "Preferred Qualifications" maybe as "Preferred Qualifications" heading? But they said use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can have Requirements (for required), Qualifications (for preferred?), Skills (maybe for technical skills?), Benefits, Pay, Schedule.
We need to avoid thin sections; prefer few substantive sections. Could combine Required and Preferred into one "Qualifications" section with subheadings? But we must use only headings, not . Could embed both required and preferred as paragraphs/lists under same heading, labeling within text.
Simplify: Use sections: About the role, Responsibilities, Requirements, Benefits, Pay, Schedule. That's six sections.
We need to include all substantive info.
Let's craft:
About the role
We have a job opportunity for a Cyber Intelligence Fusion Analyst on the DISA GSM-O Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports the Security Operations Center (SOC) Fusion mission at the Mark Center, Alexandria, Virginia. The team operates 100% onsite at the Mark Center during normal business hours, Monday through Friday, 0600–1800.
The Cyber Intelligence Fusion Analyst serves as the proactive analysis and threat-hunting engine for the SOC. The analyst synthesizes all-source threat reporting to conduct structured threat hunts, perform proactive environment sweeps, and deliver tailored analytical reports and briefings to leadership. The position combines cyber operations, threat intelligence, and analytic tradecraft to identify, characterize, and mitigate threats affecting tenants and subscribers throughout the National Capital Region. Responsibilities include correlating external intelligence with enterprise telemetry, mapping adversary TTPs, recommending detections and countermeasures, and providing threat context during incident investigations across classified, unclassified, and cloud environments.
Responsibilities
- Ingest, analyze, and synthesize cyber threat reporting from OSINT, government reporting, commercial threat-intelligence platforms, and other authorized sources to identify threats relevant to the environment.
- Correlate external threat intelligence with enterprise SIEM, EDR, endpoint, network, packet capture (PCAP), NetFlow, proxy, firewall, IDS/IPS, SSL decryption, session, and system-log telemetry to identify and assess malicious activity.
- Conduct proactive IOC sweeps and hypothesis-driven threat hunts to identify activity associated with emerging adversary campaigns, vulnerabilities, malware, targeted threats, and stealthy or evasive adversary behavior.
- Characterize adversary infrastructure, malware, tooling, and TTPs using MITRE ATT&CK, Cyber Kill Chain, and other applicable threat-modeling frameworks; assess potential risk to enterprise assets, tenants, and mission operations.
- Develop hunt plans, adversary profiles, analytic methodologies, detection logic, and complex query strategies; plan, coordinate, and execute ad hoc threat hunts; document findings and recommendations in AARs; and other required mission products.
- Develop, validate, and recommend countermeasures, including SIEM correlation searches, analytic content, custom signatures, and blocking recommendations, to improve prevention, detection, and response to known adversarial TTPs; technically vet suspicious indicators before submitting detection or blocking nominations.
- Produce recurring and ad hoc threat reports, intelligence assessments, executive summaries, situational-awareness updates, time-sensitive threat notifications, and strategic threat assessments.
- Translate technical telemetry, forensics, intelligence reporting, and analytic findings into clear, actionable technical, operational, and executive-level summaries; prepare and deliver recurring and on-demand briefings to leadership, tenant organizations, and mission partners.
- Serve as a subject matter expert on adversary tradecraft and provide threat context, intelligence support, and analytic recommendations to incident responders and other SOC teams during active investigations.
- Develop and maintain SOPs, work instructions, hunt methodologies, analytic playbooks, detection use cases, and knowledge-management artifacts; identify capability and workflow gaps, recommend improvements, and enhance automation for enrichment, case management, reporting, dashboards, and metrics.
- Provide technical leadership on complex hunts and investigations; mentor junior analysts and contribute to team training and professional development.
Requirements
Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline and 8+ years of relevant experience; additional relevant experience, cybersecurity education, or industry certifications may be substituted for a degree.
4+ years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, cyber network defense, or a closely related cyber mission.
Active Top Secret security clearance.
Must meet DoD 8140 IAT Level II baseline certification requirements before starting work and possess, or obtain and maintain within the required program timeframe, a DoD 8140 CSSP Analyst (CSSP-A) certification.
Demonstrated experience applying MITRE ATT&CK, Cyber Kill Chain, or comparable frameworks to characterize adversary activity, TTPs, attack lifecycles, vulnerabilities, malware behaviors, and indicators.
Hands-on experience conducting hypothesis-driven threat hunts, developing detection logic and analytic queries, and pivoting from external threat reporting, IOCs, and OSINT to internal enterprise telemetry.
Demonstrated experience querying, analyzing, and correlating high-volume SIEM, EDR, endpoint, network, NetFlow, packet, log, and other host- or network-based security data; working knowledge of TCP/IP, common ports and protocols, network traffic flow, OSI model, system administration, defense-in-depth, and enterprise security architecture.
Strong written, verbal, analytical, and collaboration skills, including the ability to produce technical and executive-level reports and briefings; ability to work independently, manage competing priorities, and work effectively with technical and non-technical mission partners.
Ability to work 100% onsite at the Mark Center during normal business hours; schedule flexibility may be required to support mission requirements.
Preferred Qualifications
TS/SCI eligibility, including eligibility for reciprocal acceptance, preferred.
Advanced cybersecurity certifications, such as CISSP, CASP+, CySA+, CEH, GIAC GCIH, GCIA, GCED, GCTI, or comparable credentials.
Experience supporting DISA, Department of Defense networks, Cyber Security Service Provider operations, Cyber Protection Teams, or a large enterprise SOC.
Experience conducting threat hunting and cyber investigations across NIPRNet, SIPRNet, JWICS, cloud, commercial, or similarly complex enterprise environments.
Experience using SIEM, EDR, threat-intelligence, and network-analysis tools—such as Splunk, Elastic, Microsoft Defender for Endpoint, Microsoft Sentinel, Google Threat Intelligence, VirusTotal, Wireshark, PCAP, and NetFlow—to develop or tune correlation searches, detection rules, signatures, threat blocks, analytic queries, dashboards, and automated enrichment workflows.
Familiarity with commercial threat-intelligence platforms; malware analysis; digital and network forensics; endpoint telemetry; intrusion detection; vulnerability research; cloud security; and intelligence-driven defense methodologies, including MITRE ATT&CK and Cyber Kill Chain.
Familiarity with query languages and scripting tools, such as SPL, KQL, Lucene, SQL, Python, PowerShell, and Unix/Linux command-line utilities.
Experience producing intelligence products, operational reports, and executive briefings for executives, General Officer/Flag Officer, Executive Service, or equivalent leadership; demonstrated ability to lead complex cyber investigations or threat hunts and mentor junior technical staff.
Pay
The pay range for this position is $55.00 - $60.00/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.
Benefits
- Medical, dental & vision
- Critical Illness, Accident
for prose. We need to preserve all substantive information, remove boilerplate (cookie/navigation/legal/EEO etc). Remove duplicated lines, application instructions. Also remove "Job ID / requisition numbers". Not present. We need to include sections only when posting has real specific content. We need to output only HTML fragment, no /, no markdown fences. Let's extract content: - Description: "We have a job opportunity for a Cyber Intelligence Fusion Analyst on the DISA GSM-O Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports the Security Operations Center (SOC) Fusion mission at the Mark Center, Alexandria, Virginia. The team operates 100% onsite at the Mark Center during normal business hours, Monday through Friday, 0600–1800." - Position Summary: paragraph. - Primary Responsibilities: list of bullet points. - Required Qualifications: list. - Preferred Qualifications: list. - Pay And Benefits: paragraph with pay range and benefits list. - Workplace Type: "This is a fully onsite position in Alexandria,VA." (duplicate of schedule maybe). Could combine with schedule. - Application Deadline: "This position is anticipated to close on Sep 28, 2026." Might be considered metadata; but it's not boilerplate? It's a date; we could include maybe in a short p under a heading like "Application Timeline"? But instruction: do NOT put Job ID / requisition numbers as headings — fold minor metadata into a short
or drop it. Application deadline is minor metadata; we could fold into a short p maybe under a heading? But we should avoid creating a section for minor metadata unless we have real specific content. Could include a
after description maybe. - About TEKsystems: boilerplate about company, equal opportunity, etc. Should be removed as boilerplate/legal/EEO. So drop. - San Francisco Fair Chance Ordinance etc: legal boilerplate, drop. - Use of Artificial Intelligence (AI): also boilerplate, drop. Thus final sections: About the role? Could use "About the role" heading for description and position summary? But we already have description and position summary; we could combine into a section "About the role". Or we could have separate sections: "Position Summary" and "Responsibilities". The instruction: use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can use those headings.
We need to decide which sections to include:
- About the role: could contain description and position summary.
- Responsibilities: list of primary responsibilities.
- Requirements: could contain Required Qualifications.
- Qualifications: maybe Preferred Qualifications? Or Skills? The instruction list includes Skills as possible heading. We could put Preferred Qualifications under "Skills" or "Qualifications". But we already have Required Qualifications; we could have "Requirements" for required, and "Preferred Qualifications" maybe as "Preferred Qualifications" heading? But they said use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can have Requirements (for required), Qualifications (for preferred?), Skills (maybe for technical skills?), Benefits, Pay, Schedule.
We need to avoid thin sections; prefer few substantive sections. Could combine Required and Preferred into one "Qualifications" section with subheadings? But we must use only headings, not . Could embed both required and preferred as paragraphs/lists under same heading, labeling within text.
Simplify: Use sections: About the role, Responsibilities, Requirements, Benefits, Pay, Schedule. That's six sections.
We need to include all substantive info.
Let's craft:
About the role
. Could embed both required and preferred as paragraphs/lists under same heading, labeling within text.
Simplify: Use sections: About the role, Responsibilities, Requirements, Benefits, Pay, Schedule. That's six sections.
We need to include all substantive info.
Let's craft:
About the role
We have a job opportunity for a Cyber Intelligence Fusion Analyst on the DISA GSM-O Penetration Handling, Incident, System Health (PHISH) Support Services II program. This position supports the Security Operations Center (SOC) Fusion mission at the Mark Center, Alexandria, Virginia. The team operates 100% onsite at the Mark Center during normal business hours, Monday through Friday, 0600–1800.
The Cyber Intelligence Fusion Analyst serves as the proactive analysis and threat-hunting engine for the SOC. The analyst synthesizes all-source threat reporting to conduct structured threat hunts, perform proactive environment sweeps, and deliver tailored analytical reports and briefings to leadership. The position combines cyber operations, threat intelligence, and analytic tradecraft to identify, characterize, and mitigate threats affecting tenants and subscribers throughout the National Capital Region. Responsibilities include correlating external intelligence with enterprise telemetry, mapping adversary TTPs, recommending detections and countermeasures, and providing threat context during incident investigations across classified, unclassified, and cloud environments.
Responsibilities
- Ingest, analyze, and synthesize cyber threat reporting from OSINT, government reporting, commercial threat-intelligence platforms, and other authorized sources to identify threats relevant to the environment.
- Correlate external threat intelligence with enterprise SIEM, EDR, endpoint, network, packet capture (PCAP), NetFlow, proxy, firewall, IDS/IPS, SSL decryption, session, and system-log telemetry to identify and assess malicious activity.
- Conduct proactive IOC sweeps and hypothesis-driven threat hunts to identify activity associated with emerging adversary campaigns, vulnerabilities, malware, targeted threats, and stealthy or evasive adversary behavior.
- Characterize adversary infrastructure, malware, tooling, and TTPs using MITRE ATT&CK, Cyber Kill Chain, and other applicable threat-modeling frameworks; assess potential risk to enterprise assets, tenants, and mission operations.
- Develop hunt plans, adversary profiles, analytic methodologies, detection logic, and complex query strategies; plan, coordinate, and execute ad hoc threat hunts; document findings and recommendations in AARs; and other required mission products.
- Develop, validate, and recommend countermeasures, including SIEM correlation searches, analytic content, custom signatures, and blocking recommendations, to improve prevention, detection, and response to known adversarial TTPs; technically vet suspicious indicators before submitting detection or blocking nominations.
- Produce recurring and ad hoc threat reports, intelligence assessments, executive summaries, situational-awareness updates, time-sensitive threat notifications, and strategic threat assessments.
- Translate technical telemetry, forensics, intelligence reporting, and analytic findings into clear, actionable technical, operational, and executive-level summaries; prepare and deliver recurring and on-demand briefings to leadership, tenant organizations, and mission partners.
- Serve as a subject matter expert on adversary tradecraft and provide threat context, intelligence support, and analytic recommendations to incident responders and other SOC teams during active investigations.
- Develop and maintain SOPs, work instructions, hunt methodologies, analytic playbooks, detection use cases, and knowledge-management artifacts; identify capability and workflow gaps, recommend improvements, and enhance automation for enrichment, case management, reporting, dashboards, and metrics.
- Provide technical leadership on complex hunts and investigations; mentor junior analysts and contribute to team training and professional development.
Requirements
Bachelor’s degree in cybersecurity, information technology, computer science, intelligence studies, or a related technical discipline and 8+ years of relevant experience; additional relevant experience, cybersecurity education, or industry certifications may be substituted for a degree.
4+ years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, cyber network defense, or a closely related cyber mission.
Active Top Secret security clearance.
Must meet DoD 8140 IAT Level II baseline certification requirements before starting work and possess, or obtain and maintain within the required program timeframe, a DoD 8140 CSSP Analyst (CSSP-A) certification.
Demonstrated experience applying MITRE ATT&CK, Cyber Kill Chain, or comparable frameworks to characterize adversary activity, TTPs, attack lifecycles, vulnerabilities, malware behaviors, and indicators.
Hands-on experience conducting hypothesis-driven threat hunts, developing detection logic and analytic queries, and pivoting from external threat reporting, IOCs, and OSINT to internal enterprise telemetry.
Demonstrated experience querying, analyzing, and correlating high-volume SIEM, EDR, endpoint, network, NetFlow, packet, log, and other host- or network-based security data; working knowledge of TCP/IP, common ports and protocols, network traffic flow, OSI model, system administration, defense-in-depth, and enterprise security architecture.
Strong written, verbal, analytical, and collaboration skills, including the ability to produce technical and executive-level reports and briefings; ability to work independently, manage competing priorities, and work effectively with technical and non-technical mission partners.
Ability to work 100% onsite at the Mark Center during normal business hours; schedule flexibility may be required to support mission requirements.
Preferred Qualifications
TS/SCI eligibility, including eligibility for reciprocal acceptance, preferred.
Advanced cybersecurity certifications, such as CISSP, CASP+, CySA+, CEH, GIAC GCIH, GCIA, GCED, GCTI, or comparable credentials.
Experience supporting DISA, Department of Defense networks, Cyber Security Service Provider operations, Cyber Protection Teams, or a large enterprise SOC.
Experience conducting threat hunting and cyber investigations across NIPRNet, SIPRNet, JWICS, cloud, commercial, or similarly complex enterprise environments.
Experience using SIEM, EDR, threat-intelligence, and network-analysis tools—such as Splunk, Elastic, Microsoft Defender for Endpoint, Microsoft Sentinel, Google Threat Intelligence, VirusTotal, Wireshark, PCAP, and NetFlow—to develop or tune correlation searches, detection rules, signatures, threat blocks, analytic queries, dashboards, and automated enrichment workflows.
Familiarity with commercial threat-intelligence platforms; malware analysis; digital and network forensics; endpoint telemetry; intrusion detection; vulnerability research; cloud security; and intelligence-driven defense methodologies, including MITRE ATT&CK and Cyber Kill Chain.
Familiarity with query languages and scripting tools, such as SPL, KQL, Lucene, SQL, Python, PowerShell, and Unix/Linux command-line utilities.
Experience producing intelligence products, operational reports, and executive briefings for executives, General Officer/Flag Officer, Executive Service, or equivalent leadership; demonstrated ability to lead complex cyber investigations or threat hunts and mentor junior technical staff.
Pay
The pay range for this position is $55.00 - $60.00/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.
Benefits
- Medical, dental & vision
- Critical Illness, Accident