below marketmost similar roles pay hereabove market
This role pays less than
90%
of similar roles. Most pay
$142,400–$214,000
— the blue band above.
At the midpoint, this role pays about
$122k
versus about
$178k
for comparable roles.
Based on 240 similar postings.
Employer
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.
Leidos currently has
426 open roles
on FindRole.
Listed pay typically runs
$92,300–$166,850
across 344 roles with salary data.
The DTIP Integrations SME joins the Digital Modernization sector to serve as the mission owner for the Threat Intelligence Platform. This role involves providing sustained support for CTI fusion, low-regret model scoring, and implementing blocking actions to create advanced defensive capabilities for the Department of War Information Network. You will integrate threat feeds across DISA security solutions including Cloud Based Internet Isolation, Palo Alto, Enterprise Recursive Services, and Versa. Daily tasks include mapping adversary activities using the MITRE ATT&CK Framework, analyzing threat reports, and producing recommendations for government officials. Required technical skills include Python programming, JSON and YAML configuration editing, and Git version control. You must also possess experience with STIX and TAXII standards to automate threat intelligence solutions across enterprise security platforms.
Act as the mission owner for sustained Threat Intelligence Platform support and CTI fusion.
Integrate threat feeds across DISA capabilities including CBII, Palo Alto, ERS, and Versa.
Implement automated blocking capabilities and integrate block lists using the Bladeguard solution.
Fuse multiple intelligence sources to develop comprehensive products and strategic recommendations.
Research current threats and map adversary activities using the MITRE ATT&CK Framework.
Analyze threat intelligence reports to evaluate adversary capabilities, intentions, tactics, and behaviors.
Produce high-quality papers and presentations for senior government intelligence and operations officials.
Support government stakeholders with IOC management, blocking actions, and overall troubleshooting.
What we're looking for
Must have an active TS/SCI security clearance.
Must have a Bachelor's degree in a related discipline and 4+ years of directly relevant experience, or additional experience in lieu of a degree.
Must have 2+ years of experience working with Threat Intelligence Platforms (TIPs) and configuring threat feed integrations.
Must be proficient in programming using Python.
Must have proven experience with configuration editing using both JSON and YAML.
Must have experience leveraging version control systems such as Git.
Must have applied knowledge of security solutions including CBII, Palo Alto, ERS, and Versa.
Must have 8140 Cyber Defense Infrastructure Support Specialist 521 (CS) Intermediate-level compliance, including Security+, PenTest+, CySA+, GSEC, or GMON.
SIEM
Kibana
Sentinel
MDE
Tines
Darktrace
Splunk
Detection-as-Code
Linux
Windows
Unix
API Development
TCP/IP
Netflow
Full Packet Capture
Malware Analysis
Cyber Kill Chain
Scripting