> Markdown version of [/jobs/ext/1697594-cyber-intrusion-analyst](https://www.wearedevelopers.com/jobs/ext/1697594-cyber-intrusion-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Intrusion Analyst - **Company:** Leidos, Inc. - **Location:** San Antonio, TX, United States - **Salary:** $69,550.0 - $125,725.0 - **Contract:** Permanent contract - **Skills:** HTML, Java (Programming Language), JavaScript (Programming Language), Command-Line Interface, Communications Protocols, CompTIA Security+, Cyber Security, Computer Networks, Linux, Perl (Programming Language), Issue Tracking Systems, Intrusion Detection and Prevention, Intrusion Detection Systems, Python (Programming Language), MySQL, Network Forensics, Network Monitoring, Shell Script, Security Information and Event Management, Transmission Control Protocol (TCP), Traffic Analysis, Wireshark, Network Simulation, Scripting, Mitre Att&ck, Firewalls (Computer Science), SC Clearance, Information Technology, Splunk - **Published:** July 6, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9013752/cyber-intrusion-analyst ## About the Role * Ability to obtain Secret Clearance. Ability to achieve TS/SCI clearance level * Bachelor's, additional relevant work experience and/or military service may be considered in lieu of degree * Networking: TCP/IP Fundamentals, Network Traffic Analysis, Wireshark, Cisco Packet Tracer * Programming: Python, Java, JavaScript, HTML * Systems: Linux, Operating Systems Concepts, Computer Architecture, MySQL * Security & Analysis: Security Monitoring, Threat Detection Concepts, SIEM Concepts, Risk Mitigation, NIST Framework Concepts * Experience working with DoW / Government. * Strong computing system knowledge, particularly networking, including a knowledge of communication protocols and familiarity with common computing security elements such as IDS/IPS systems and firewalls. Preferred Qualifications. * Active DOW Secret Clearance. * CompTIA Security+, TCP/IP networking, Linux systems, Cisco Packet Tracer, Wireshark * Familiarity with Military Regulations and security compliance procedures * Experience with both CONUS and OCONUS threat environments to Department of War facilities. * Command Line Scripting skills (PERL, python, shell scripting) to automate analysis task. * Knowledge of hacker tactics, techniques and procedures (TTP). * Familiarity with computing security frameworks such as MITRE ATT&CK and Cyber Kill Chain. * Monitoring of intrusion detection and computer defense appliances (Splunk, Elastic), applications, and analysis of associated alerts. * Knowledge of advanced threat actor tactics, techniques, and procedures (TTP) * Understanding of software exploits. ## Description The Defense Sector at Leidos currently has an opening for a Cyber Intrusion Analyst with a active SECRET clearance! Primary Responsibilities. * Leadership & Team Development * Member of the IMCOM HHA team, ensuring compliance with Army quality and regulatory standards. * Provide hands-on leadership to the IMCOM HHA team, mentoring and developing inspectors to ensure efficient operational support and continuous improvement. * Perform computer network inspections to mitigate / prevent incident detection, and response activities to detect, correlate, identify and characterize anomalous activity that may be indicative of threats to the enterprise. * Monitor various security tools and applications for possible malicious activities, investigate any associated alerts or indicators, and develop recommendations for a course of action, including mitigation strategies as necessary. * Conduct analysis of low-level ("low and slow") events to identify unauthorized activity utilizing exploratory problem-solving or self-learning techniques. * Conduct event triage and analysis, which can result in network traffic validations or a Mission Partner's incident report. * Utilize formal monitoring policies and procedures that include the appropriate use of DoD-approved network monitoring and traffic analysis tools to assist with identifying suspicious, anomalous, or overtly malicious network traffic on a 24/7/365 basis. * Review and analyze available logs in a timely manner to detect intruders and notify Mission Partners of activity through a formal reporting process/pending an incident report. * Apply, develop, tune, and distribute or optimize new and existing countermeasures or guidance to prevent or mitigate potential cyber event impacts when possible. * Perform network traffic analysis utilizing raw packet data, net flow, IDS, IPS and custom sensor output, as it pertains to the cyber security of communications networks. * Understand attack signatures, tactics, techniques, and procedures associated with advanced threats. * Requires good technical writing skills as each event, including the associated analysis, are documented in a ticketing system for review and action. * Requires excellent communication skills as we are collocated with our customer and regular face-to-face interaction is necessary throughout the day, as well as significant coordination and communication between team members. ## Related Videos - [The Resilience of the World Wide Web](https://www.wearedevelopers.com/videos/1281-the-resilience-of-the-world-wide-web) - [MySQL Protocol Features You Should Be Aware Of](https://www.wearedevelopers.com/videos/100267-mysql-protocol-features-you-should-be-aware-of) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer)