> Markdown version of [/jobs/ext/1654281-cyber-threat-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/1654281-cyber-threat-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Threat Intelligence Analyst - **Company:** AspenView Technology Partners - **Location:** Spain (Remote available) - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Cyber Security, Computer Telephony Integration, Python (Programming Language), Open Source Intelligence, Software Vulnerability Management, Scripting, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Low-code - **Published:** July 3, 2026 - **Apply:** https://es.indeed.com/viewjob?jk=5453ca35d4f5c473 ## About the Role CTI Platforms: Comfort working with at least one intelligence or security operations platform (e.g., a threat intelligence platform, SIEM, or SOAR). Nice to have: Silobreaker, CrowdStrike Recon+, BlueVoyant, or Flashpoint. What you bring: Experience: 1-3 years of experience in cyber threat intelligence or a closely related security role (SOC, incident response, vulnerability management, or similar). Communication: Solid written English, with the ability to produce clear, well-structured intelligence reporting for varied audiences. Framework Knowledge: Familiarity with the MITRE ATT&CK framework and how to apply it to adversary behavior. Platform Experience: Comfort working with at least one intelligence or security operations platform. Mindset: A curious, detail-oriented analytical mindset and good judgment about source reliability. Education: Bachelor's degree in Cybersecurity, Information Security, Computer Science, Intelligence Studies, or a related field, or equivalent practical experience. Nice if you have: Strong Differentiator: Ability to set up lightweight automations and integrations across the CTI toolstack, connecting feeds and enrichments, wiring tools together through APIs, and removing repetitive manual steps. Platform Exposure: Prior exposure to one or more CTI platforms such as Silobreaker, CrowdStrike Recon+, BlueVoyant, or Flashpoint. Scripting/Automation: Light scripting (e.g., Python) or no-/low-code automation experience. OSINT: Familiarity with OSINT techniques and IOC enrichment. ## Description We are seeking a Junior Cyber Threat Intelligence (CTI) Analyst to support a growing intelligence function within an enterprise security team. Working alongside senior analysts, you will collect, analyze, and contextualize threat data, mapping adversary behavior to MITRE ATT&CK, tracking indicators and tactics, and turning raw signals into clear, actionable intelligence for technical and business stakeholders. This is a hands-on, growth-oriented role for someone early in their CTI career who is curious, detail-oriented, and eager to sharpen both their analytical tradecraft and their automation skills across a modern CTI toolstack. What you will do: Intelligence Collection & Analysis Gather threat data from internal platforms, OSINT, and commercial intelligence feeds, and assess its relevance and reliability. Map observed adversary tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. Indicator & Threat Tracking Track indicators of compromise (IOCs), threat actors, campaigns, and emerging vulnerabilities relevant to the organization. Maintain accurate, well-structured records within the team's intelligence platform(s). Reporting & Communication Produce clear, concise written intelligence, including alerts, summaries, and briefings, tailored to technical and non-technical audiences. Support senior analysts with research for deeper threat assessments and stakeholder requests. Tooling & Automation Help set up lightweight automations and integrations across the CTI toolstack to reduce manual effort and speed up analysis. Keep feeds, enrichments, and platform configurations tidy and dependable. Collaboration & Growth Work with SecOps, incident response, and vulnerability teams to share relevant intelligence. Continuously build tradecraft, including frameworks, sources, and analytic techniques, under the guidance of senior analysts. ## Related Videos - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Reimagining app development with Low-code and AI](https://www.wearedevelopers.com/videos/1651-reimagining-app-development-with-low-code-and-ai) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [What If Apps Built Themselves? AI-Powered Low-Code for the Industrial Enterprise](https://www.wearedevelopers.com/videos/2079-what-if-apps-built-themselves-ai-powered-low-code-for-the-industrial-enterprise) - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)