> Markdown version of [/jobs/ext/4700616-cyber-threat-intelligence-soar-automation-analyst](https://www.wearedevelopers.com/jobs/ext/4700616-cyber-threat-intelligence-soar-automation-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Intelligence & SOAR Automation Analyst

- **Company:** Leidos, Inc.
- **Location:** Columbus, OH, United States
- **Experience:** Experienced
- **Salary:** $87,100 - $157,450
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Bash Shell, Big Data, Cyber Security, Computer Telephony Integration, Data Dictionary, Issue Tracking Systems, Intelligence Analysis, JSON, Python (Programming Language), Windows PowerShell, Comptia Pentest+ CE, Zero Trust Network Access, Security Information and Event Management, YAML, Scripting, Data Ingestion, Power Platform Integration, Mitre Att&ck, Cyber Threat Analysis, Git, Information Technology, Api Design, Restful APIs, Cyber Warfare, Splunk, Software Version Control, Docker
- **Published:** November 13, 2026
- **Apply:** https://www.columbusjobsite.com/job.asp?id=3517374683&tx=JL2923FFG&pt=1&aff=0B19D771-A501-4A5E-8338-2A822B784D54&utm_source=Job%20Feed&utm_medium=textkernel&utm_campaign=DE&utm_term=0B19D771-A501-4A5E-8338-2A822B784D54

## About the Role

* Clearance: Active Top Secret / Sensitive Compartmented Information (TS/SCI)
 * Education & Experience: Bachelor's in Computer Science, Cybersecurity, IT, or a related discipline plus 4+ years of relevant hands-on operational experience.
 * Threat Intelligence Platform (TIP) Experience: experience working with TIP managing IOC lifecycles and configuring threat feed ingestions.
 * SOAR & Playbook Development: Proven hands-on experience designing and implementing automated workflows and playbooks using SOAR platforms.
 * Scripting & Tooling: Strong scripting skills in Python for API interactions and data parsing, with supplemental experience in Bash or PowerShell.
 * Data Formats & Version Control: Proven ability to create, edit, and validate configuration files and schemas in JSON, YAML, and Git for code management.
 * Enterprise Security Stacks: Applied technical understanding of enterprise security solutions and their integration mechanisms.
 * DoD Compliance: Must possess an active DoD 8140/8570 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level baseline certification (e.g., Security+ CE, PenTest+, CySA+, GSEC, or GMON).

Preferred Qualifications

 * Low-Regret Triage & IACD: Applied experience utilizing Integrated Adaptive Cyber Defense (IACD) low-regret scoring principles to automate indicator blocking with minimal mission impact.
 * Cyber Intelligence Communication Standards: Practical experience parsing and structuring STIX/TAXII intelligence feeds and maintaining CTI data dictionaries.
 * Adversary Analysis: Deep understanding of adversary TTPs and practical experience conducting adversary assessment via MITRE ATT&CK.
 * SIEM & Big Data: Familiarity querying and integrating workflows with log management and SIEM platforms such as Splunk or Elastic (ELK).
 * Zero Trust: Baseline understanding of Zero Trust Architecture (ZTA) concepts and principles.
 * Additional Experience: Any experience with ThreatQ TIP and/or Tines

## Description

Leidos' Digital Sector is seeking an experienced, multidisciplinary Cyber Threat Intelligence & SOAR Automation Analyst supporting DISA Global. This hybrid technical role bridges day-to-day Cyber Threat Intelligence (CTI) automation with operational Security Orchestration, Automation, and Response (SOAR) solutions development., * Hands-on Intelligence Analysis & Feed Curation: Analyze threat intelligence reporting, assess emerging threats, map adversary tactics to the MITRE ATT&CK framework, and evaluate indicators across diverse external and internal feeds.

 * DISA TIP Administration & Indicator Lifecycle Management: Configure, maintain, and optimize DTIP feed ingestion pipelines (STIX/TAXII), manage IOC repositories, maintain data dictionaries, and tune indicator expiration policies.
 * Automated Defensive Blocking & Sensor Integration: Implement low-regret scoring logic and automated blocklist distribution for security solutions.
 * API Development & Custom Connectors: Write robust Python scripts and utilize REST APIs to interconnect DTIP, Tines, ticketing systems, and SIEM/log repositories.
 * Investigation & Operational Triage Support: Support Cyber Security Watch Officers (CSWOs) with indicator validation, false-positive troubleshooting, and rapid-response containment workflows.
 * SOAR Playbook Development & Execution: Design, build, test, and optimize automated incident response and threat-enrichment playbooks within Tines to streamline 24x7 SOC monitoring workflows.
 * Platform Maintenance & Sustainment: Assist in sustaining and securing core automation and intelligence platforms, maintaining containerized services (Docker), applying STIG configurations, and leveraging Git for version control.
 * Technical Intelligence Reporting: Produce technical intelligence briefs, indicator documentation, and triage summaries to inform ongoing defensive operations.