> Markdown version of [/jobs/ext/4006189-ncyber-threat-analyst](https://www.wearedevelopers.com/jobs/ext/4006189-ncyber-threat-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# nCyber Threat Analyst

- **Company:** Nabout Leidos
- **Location:** United States
- **Experience:** Expert
- **Salary:** $87,100.0 - $157,450.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Artificial Intelligence, Static Program Analysis, Domain Name System (DNS), NetFlow, Packet Analyzer, Open Source Intelligence, Kusto Query Language, Security Information and Event Management, GIAC Cyber Threat Intelligence, Malware, Cyber Threat Analysis, Microsoft Sentinel, Google Gemini, Kibana, Cyber Warfare, Splunk, GPT
- **Published:** October 29, 2026
- **Apply:** https://jobs.military.com/career/381014/cyber-threat-analyst-hawaii-hi-pearl-harbor

## About the Role

u2022 Bachelor's degree with \n4+ years of relevant experience; OR an Associate degree with 6+ years; OR 8+ years of relevant experience / military service in lieu of a degree.\n
\n, u2022 Must hold a valid certification or degree compliant with \nDoD 8140.03 / DCWF Work Role Code 531: Cyber Defense Incident Responder or equivalent (Intermediate proficiency level) prior to start date:\n
\u2022 Accepted Certifications include: \nCompTIA CySA+, GCTI (GIAC Cyber Threat Intelligence), CEH, CFR, GCIA, GCIH, CND, or advanced credentials such as CISSP, CASP+ CE, or GCFA.\n
\u2022 Privileged Access (SA/SSP) eligibility: Willingness to obtain and maintain system access credentials as required by operational mission requirements.\n
\n
\nCore Technical Competencies\n
\u2022 In-depth understanding of adversary tactics, techniques, and procedures, threat actor attribution, and mapping adversary activity to the \nMITRE ATT&CK® framework.\n
\u2022 Experience authoring structured threat intelligence products, technical threat briefs, intelligence summaries, and operational Tippers.\n
\u2022 Proven ability to analyze raw packet captures, Netflow, proxy/DNS logs, firewall telemetry, and endpoint logs to reconstruct adversary intrusions.\n
\u2022 Hands-on familiarity querying enterprise SIEM platforms (Splunk SPL, Elastic/Kibana, Microsoft Sentinel KQL).\n
\u2022 Working knowledge of common threat intelligence platforms and tools (e.g., MISP, ThreatConnect, Anomali, VirusTotal, Shodan).\n
\u2022 Willingness and ability to work standard operational shifts with occasional surge/after-hours support during critical incidents or crisis contingencies.\n
\n, u2022 Prior experience supporting USPACOM, DISA Pacific, DJOC, Joint Cyber Centers, or Service Component DCO units (e.g., 10th Fleet, 16th Air Force, ARCYBER).\n
\u2022 Experience conducting structured threat-hunting (DCI/DD) across cloud and enterprise on-premises networks.\n
\u2022 Knowledge of malware triage and dynamic/static analysis concepts (e.g., sandboxing, de-obfuscation, hashing, C2 extraction).\n
\u2022 Familiarity with AI prompting (Gemini, Grok, ChatGPT) for automation and OSINT data collection.\n