InInsider Threat Program Hunt Team Analyst

About the role

The Digital Sector at Leidos is seeking a Hunt Analyst to support the HEITS Contract as part of the Department of Homeland Security (DHS) Insider Threat Program (ITP). The analyst will support, sustain, design, and evolve the database backbone of the ITP, which identifies insider threats through advanced analytics, monitoring, and data correlation to protect the DHS mission.

Responsibilities

• Examine, analyze, and search insider threat data to identify trends, patterns, and insights of potential insider threat indicators.
• Provide analytical and program support services related to the operation of the UAM/UEBA tool.
• Monitor the UAM platform to identify emerging requirements related to insider threat events and coordinate across the enterprise to ensure timely response.
• Conduct research on the UAM platform to identify patterns of concerning behavior related to potential insider threat risk to the DHS enterprise.
• Provide proactive insider‑threat‑based hunting across the DHS enterprise network, leveraging methodologies and behavioral analytics to detect, investigate, and mitigate anomalous activity and policy violations indicative of malicious insider behavior.
• Conduct continuous hunt operations across data and log sources, DHS platforms, EDR tools, and network traffic to identify patterns of insider threat behavior.
• Identify mitigation strategies to assist the investigative team in effectively reducing insider threat risk.
• Utilize UEBA (User and Entity Behavior Analytics) platforms and techniques to baseline user activity and detect deviations.
• Provide timely response to critical/high UAM alerts (within 4 hours during normal business hours).

Schedule

Normal business hours will be defined as a schedule combination to include weekdays 2 pm–10 pm shift and weekends 6 am–6 pm shift. The candidate will have 2–3 days off based on the schedule determined, and the work week should not exceed 40 hours. This position is expected to eventually move to shift work to meet the requirement of 24 × 7 operations at an undetermined later date.

Basic Qualifications

• Bachelor’s degree and 12+ years of prior relevant insider‑threat experience, or Master’s degree with 10+ years of prior relevant experience; additional years of experience with requisite certifications may be considered in lieu of a degree.
• Minimum of 10+ years demonstrated knowledge of the intelligence cycle, analytic techniques, systems, processes, and organizations.
• Minimum of 10+ years demonstrated knowledge of Threat Assessment & Mitigation Strategies.
• Excellent written and verbal communication skills with ability to deliver briefings to diverse audiences.
• Knowledge of current domestic and international threats to U.S. national security interests.
• Ability to establish networks with relevant security, personnel, and prevention stakeholders to foster program utilization.
• Self‑starter capable of working independently to promote program goals.
• Working knowledge of User Activity Monitoring (UAM) software and solutions.
• Working knowledge of cybersecurity toolsets designed to support ITP mission activities.
• Working knowledge of open‑source toolsets.
• Working knowledge of Insider Threat Frameworks; Pathway to Violence & Critical Pathway.
• Current TS/SCI clearance and U.S. citizenship.
• Ability to obtain DHS EOD SCI and willingness to undergo a CI polygraph.

Preferred Qualifications

• Master’s degree in Criminal Justice, Homeland Security, Cyber Security, or a related field.
• Proven experience (10+ years) in Intelligence Analysis.
• Experience with User Activity Monitoring products and platforms.
• Proven experience (4+ years) in Threat Assessment & Mitigation.
• Certified Counter‑Insider Threat Professional – Fundamentals (CCITP‑F).
• Certified Counter‑Insider Threat Professional – Analysis (CCITP‑A).
• Completion of the Center for Development of Security Excellence (CDSE) Insider Threat Detection Analysis Course (ITDAC).
• Completion of the Workplace Assessment of Violence Risk (WAVR‑21) Workshop.
• Completion of CDSE curricula: INT311.CU, INT312.CU, CI201.CU.

Pay

Pay Range: $105,300.00 – $190,350.00.

Benefits

Employment benefits include competitive compensation, health and wellness programs, income protection, paid leave, and retirement. More details are available at www.leidos.com/careers/pay-benefits.