Cyber Threat Intelligence, SOAR Automation Analyst

Leidos

. Analyze threat intelligence reporting, assess emerging threats, map adversary tactics to the MITRE ATT&CK framework, and evaluate indicators across external and internal feeds .

Posted 11/11/2026full-timeUnited StatesMid-LevelSenior💰 $87,100 - $157,450 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat intelligence analysis, including the use of the MITRE ATT&CK framework and automation of incident response workflows. Proficient in Python scripting for API interactions and managing threat intelligence platforms.

Highest-signal resume keywords

Threat Intelligence AnalysisPython ScriptingThreat Intelligence Platforms (TIP)Automation WorkflowsActive Top Secret / Sensitive Compartmented Information (TS/SCI) Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat Intelligence AnalysisPython ScriptingAutomation WorkflowsConfiguration ManagementData ParsingIncident Response PlaybooksIOC Lifecycle ManagementSTIX/TAXII ConfigurationVersion Control with GitJSON and YAML Configuration

Tools & Technologies

DockerTinesSIEMREST APIsSplunkElastic (ELK)Zero Trust ArchitectureThreatQ TIP

Certifications & Qualifications

Active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 (CS)Security+ CEPenTest+CySA+GSECGMON

Industry Keywords

MITRE ATT&CKLow-Regret ScoringCybersecurityThreat IntelligenceIOC Repositories

Tech Stack

Tools & technologies

Cyber SecurityDockerPythonSplunkTypeScript

About the role

Key responsibilities & impact

Analyze threat intelligence reporting, assess emerging threats, map adversary tactics to the MITRE ATT&CK framework, and evaluate indicators across external and internal feeds
Configure, maintain, and optimize DTIP feed ingestion pipelines using STIX/TAXII
Manage IOC repositories, data dictionaries, and indicator expiration policies
Implement low-regret scoring logic and automated blocklist distribution for security solutions
Write Python scripts and use REST APIs to interconnect DTIP, Tines, ticketing systems, and SIEM/log repositories
Support Cyber Security Watch Officers with indicator validation, false-positive troubleshooting, and rapid-response containment workflows
Design, build, test, and optimize Tines incident-response and threat-enrichment playbooks
Sustain and secure automation and intelligence platforms, including Docker containerized services and STIG configurations
Use Git for version control
Produce technical intelligence briefs, indicator documentation, and triage summaries

Requirements

What you’ll need

Active Top Secret / Sensitive Compartmented Information (TS/SCI) clearance
Bachelor’s in Computer Science, Cybersecurity, IT, or a related discipline
4+ years of relevant hands-on operational experience
Experience working with Threat Intelligence Platforms (TIP), managing IOC lifecycles, and configuring threat feed ingestions
Hands-on experience designing and implementing automated workflows and playbooks using SOAR platforms
Strong scripting skills in Python for API interactions and data parsing
Supplemental experience in Bash or PowerShell
Ability to create, edit, and validate configuration files and schemas in JSON and YAML
Git experience for code management
Applied technical understanding of enterprise security solutions and integration mechanisms
Active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level baseline certification, such as Security+ CE, PenTest+, CySA+, GSEC, or GMON
Preferred: experience with IACD low-regret scoring principles, STIX/TAXII feeds, CTI data dictionaries, MITRE ATT&CK, Splunk or Elastic (ELK), Zero Trust Architecture, ThreatQ TIP, and/or Tines