Cyber Threat Intelligence Analyst
Role details
Job location
Tech stack
Job description
We are seeking a Junior Cyber Threat Intelligence (CTI) Analyst to support a growing intelligence function within an enterprise security team. Working alongside senior analysts, you will collect, analyze, and contextualize threat data, mapping adversary behavior to MITRE ATT&CK, tracking indicators and tactics, and turning raw signals into clear, actionable intelligence for technical and business stakeholders. This is a hands-on, growth-oriented role for someone early in their CTI career who is curious, detail-oriented, and eager to sharpen both their analytical tradecraft and their automation skills across a modern CTI toolstack.
What you will do:
Intelligence Collection & Analysis
Gather threat data from internal platforms, OSINT, and commercial intelligence feeds, and assess its relevance and reliability.
Map observed adversary tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework.
Indicator & Threat Tracking
Track indicators of compromise (IOCs), threat actors, campaigns, and emerging vulnerabilities relevant to the organization.
Maintain accurate, well-structured records within the team's intelligence platform(s).
Reporting & Communication
Produce clear, concise written intelligence, including alerts, summaries, and briefings, tailored to technical and non-technical audiences.
Support senior analysts with research for deeper threat assessments and stakeholder requests.
Tooling & Automation
Help set up lightweight automations and integrations across the CTI toolstack to reduce manual effort and speed up analysis.
Keep feeds, enrichments, and platform configurations tidy and dependable.
Collaboration & Growth
Work with SecOps, incident response, and vulnerability teams to share relevant intelligence.
Continuously build tradecraft, including frameworks, sources, and analytic techniques, under the guidance of senior analysts.
Requirements
CTI Platforms: Comfort working with at least one intelligence or security operations platform (e.g., a threat intelligence platform, SIEM, or SOAR).
Nice to have: Silobreaker, CrowdStrike Recon+, BlueVoyant, or Flashpoint.
What you bring:
Experience: 1-3 years of experience in cyber threat intelligence or a closely related security role (SOC, incident response, vulnerability management, or similar).
Communication: Solid written English, with the ability to produce clear, well-structured intelligence reporting for varied audiences.
Framework Knowledge: Familiarity with the MITRE ATT&CK framework and how to apply it to adversary behavior.
Platform Experience: Comfort working with at least one intelligence or security operations platform.
Mindset: A curious, detail-oriented analytical mindset and good judgment about source reliability.
Education: Bachelor's degree in Cybersecurity, Information Security, Computer Science, Intelligence Studies, or a related field, or equivalent practical experience.
Nice if you have:
Strong Differentiator: Ability to set up lightweight automations and integrations across the CTI toolstack, connecting feeds and enrichments, wiring tools together through APIs, and removing repetitive manual steps.
Platform Exposure: Prior exposure to one or more CTI platforms such as Silobreaker, CrowdStrike Recon+, BlueVoyant, or Flashpoint.
Scripting/Automation: Light scripting (e.g., Python) or no-/low-code automation experience.
OSINT: Familiarity with OSINT techniques and IOC enrichment.