DTIP Integrations SME

Leidos Digital Modernization sector has a current job opportunity for aThreat Intelligence Platform Integrations SME. We are seeking an experienced Cyber Threat Intelligence (CTI) professional to act as a mission owner for our Threat Intelligence Platform. As a Threat Intelligence Platform Integrations SME at DISA Global you will provide sustained support for CTI fusion low-regret model scoring and the implementation of blocking actions to create advanced defensive capabilities. You will play a critical role in maintaining this capability optimizing its performance and integrating it across various DISA security solutions to enhance the overall defense of the Department of War Information Network (DoWIN).

You will use your technical expertise to enable the fusion of intelligence inform threat investigations and drive automated defense mechanisms. Additionally you will continue to strengthen your skills while supporting the sustainment and development of critical platforms in support of the DoW and COCOMs.

This position can be based out of any of our three core sites - Scott AFB IL; Hill AFB UT; or Columbus OH. Partial/hybrid telework may be allowed but a consistent on-site presence is required.

PRIMARY RESPONSIBILITIES:

• Act as the mission owner for sustained Threat Intelligence Platform support driving CTI fusion low-regret model scoring and the integration of blocking capabilities.
• Maintain and enhance capability performance by integrating threat feeds across various DISA capabilities including Cloud Based Internet Isolation (CBII) Palo Alto Enterprise Recursive Services (ERS) and Versa.
• Integrate block lists to support automated defensive solutions specifically leveraging the Bladeguard solution.
• Fuse multiple intelligence sources to develop comprehensive products provide strategic recommendations and prioritize organizational focus.
• Research and investigate current threats; map adversary activities using the MITRE ATT&CK Framework.
• Analyze data and threat intelligence reports to evaluate adversary capabilities intentions tactics and behaviors.
• Produce high-quality papers presentations and recommendations for senior U.S. government intelligence and operations officials.
• Support government and CSWOs in the areas of IOC management blocking and overall troubleshooting

BASIC QUALIFICATIONS:

• Must have an active TS/SCI due to classified intelligence analysis.
• Bachelors degree in a related discipline and 4 years of directly relevant experience; additional related years of experience is accepted in lieu of a degree.
• 2 years of experienceworking with Threat Intelligence Platforms (TIPs) and configuring threat feed integrations.
• Proficiency in programming usingPython.
• Proven experience with configuration editing using bothJSON and YAML.
• Experience with leveraging version control systems such asGit.
• Applied knowledge of various security solutions and their integrations as employed in enterprise environments specifically CBII Palo Alto ERS and Versa.
• Requires 8140 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level compliance to include one of the following certifications: Security PenTest CySA GSEC or GMON.

PREFERRED SKILLS:

• Deep understanding of defensive tactics techniques and procedures (TTPs) for threat detection and response.
• Experience with automated block list integrations and solutions.
• Experience with integration of systems as well as assessing scoring and operationalizing new CTI feeds
• Knowledge utilizing STIX and TAXII standards to develop configure and automate threat intelligence solutions across enterprise security platforms
• Experience with Integrated Adaptive Cyber Defense: Low-Regret Methodology for CTI Triage
• Advanced experience assessing emerging threats and vulnerabilities and the CTI lifecycle.
• Skills building and reading data dictionaries
• Exceptional written and verbal communication skills tailored for senior intelligence and operational leadership.
• Prior experience functioning as a capability or mission owner within a DoW or Intelligence Community environment.

If youre looking for comfort keep scrolling. At Leidos we outthink outbuild and outpace the status quo because the mission demands it. Were not hiring followers. Were recruiting the ones who disrupt provoke and refuse to fail. Step 10 is ancient history. Were already at step 30 and moving faster than anyone else dares.

The Leidos pay range for this job level is a general guideline onlyand not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job education experience knowledge skills and abilities as well as internal equity alignment with market data applicable bargaining agreement (if any) or other law.