> Markdown version of [/jobs/ext/2787907-cybersecurity-threat-analyst-i](https://www.wearedevelopers.com/jobs/ext/2787907-cybersecurity-threat-analyst-i). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cybersecurity Threat Analyst I

- **Company:** Invictus Inc.
- **Location:** Colorado Springs, CO, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Data Analysis, Identity and Access Management, Search Technologies, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Cybercrime
- **Published:** September 8, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9148809/cybersecurity-threat-analyst-i

## About the Role

Clearance: TS/SCI with the ability to obtain and maintain a CI polygraph, * Bachelor's degree from an accredited institute in a technical discipline applicable to the position; an additional 4 years of may be substituted in lieu of a degree

 * Minimum two (2) years of relevant experience in addition to education level
 * Foundational knowledge of common cyber threats, indicators of compromise, network/host artifacts, and security monitoring concepts
 * Familiarity with SIEM/search technologies, threat intelligence, MITRE ATT&CK, or security data analysis is desired
 * Ability to document analytical reasoning and communicate findings clearly
 * Must possess current DoD 8570 IAT II or IAM II certification
 * Experience working in a DoD or IC environment desired
 * Current active TS/SCI clearance, with the ability to obtain and maintain a CI polygraph

## Description

* Support proactive threat analysis and hunt activities using established hypotheses, queries, procedures, and data sources
 * Proactively analyze security telemetry to identify indicators of compromise, anomalous behavior, and adversary activity that has not met an incident threshold or has evaded automated security controls
 * Assess and correlate data from multiple sources, including network, endpoint, identity, SIEM, threat intelligence, vulnerability, and other available security data
 * Document hunt activity, findings, evidence, and recommended follow-on actions in authorized systems and initiate or support incident-response processes when malicious activity is identified
 * Provide relevant findings and trends for SOC operational reporting, significant-activity reporting, and defensive awareness
 * Research indicators, adversary behaviors, and suspicious activity under guidance from senior threat personnel.
 * Maintain clear hunt notes and document negative as well as positive findings to support repeatability and knowledge development
 * Escalate suspicious activity and potential detection gaps to senior threat analysts and watch operations


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Data Science in Retail](https://www.wearedevelopers.com/videos/586-data-science-in-retail)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [Data Science on Software Data](https://www.wearedevelopers.com/videos/162-data-science-on-software-data)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf)