> Markdown version of [/jobs/ext/2189887-principal-cyber-def-threat-intell-analyst](https://www.wearedevelopers.com/jobs/ext/2189887-principal-cyber-def-threat-intell-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Principal Cyber Def Threat Intell Analyst - **Company:** Exelon Corporation - **Location:** Philadelphia, PA, United States - **Experience:** Experienced - **Salary:** $136,800.0 - **Contract:** Permanent contract - **Skills:** Systems Engineering, Complex Networks, Cyber Security, Information Systems, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Network Forensics, Open Source Intelligence, Security Information and Event Management, Software Vulnerability Management, Scripting, Real Time Systems, Mitre Att&ck, Malware, Cyber Threat Analysis, Tactics, Techniques and Procedures (TTPs), Information Technology, Cybercrime, Cyber Warfare - **Published:** August 22, 2026 - **Apply:** https://dejobs.org/x/x/89C9419CC3D14E5DAC830F98495F5372/job/ ## About the Role * Bachelor's Degree in Computer Science, Information Systems, or other related 4-year technical degree or equivalent military / government experience and typically 5 to 8 years of solid, diverse experience in IT, cybersecurity, real-time systems, or equivalent combination of education and work experience. * Must be willing to travel to Golden, Colorado, monthly or as required by job duties. * Must be willing to obtain and maintain a US government TS/SCI security clearance. * Experience in operational technology defense and engineering concepts. * Proven threat hunting experience and ability to track adversaries through knowledge of their tactics, techniques and procedures (TTPs), MITRE ATT&CK framework, open-source intelligence (OSINT) collection and deception techniques. * Proficient in security tools such as SIEM solutions, intrusion detection and prevention systems (IDS/IPS), threat intelligence platforms, and security orchestration, automation and response (SOAR) solutions to centralize and manage incident and remediation workflow. * Experience in incident handling, vulnerability management, hacking tools, intelligence gathering and kill chain methodology. * Experience participating in collaborative threat analysis meetings with internal and external trusted entities. * Ability to analyze incident logs, assess malware, and understand vulnerabilities and exploits, along with strong operating systems knowledge. * Demonstrated understanding and comprehension of a wide range of network and host cybersecurity solutions. * Strong written and verbal communication skills across all levels of the organization. * One or more of the following, or an equivalent: * GIAC Certified Intrusion Analyst * GCIA GIAC Certified Incident Handler * GCIH GIAC Cyber Threat Intelligence * GCTI GIAC Network Forensic Analyst * GNFA Offensive Security Certified Professional * OSCP Preferred Qualifications * Graduate degree in cyber security, intelligence and analysis, or related area of expertise. * Minimum 3 years of experience supporting the energy sector. * Experience in network security environment (Security Operations Center, Security Incident Response Team, or Cyber Security Incident Response) investigating targeted intrusions through complex network segments. * Existing US government security clearance with experience working with sensitive classified data. ## Description The Principal Cyber Defense Threat Intelligence Analyst (CDTIA) identifies, collects, and monitors appropriate threat intelligence information from various sources to analyze, synthesize, and provide actionable intelligence reports and briefings to the joint security operations center (JSOC) and other information technology (IT) and operational technology (OT) teams. The CDTIA specifically collaborates with the Energy Threat Analysis Center (ETAC) under the Department of Energy (DOE), in Golden, Colorado, to operationalize cyber and physical threat intelligence in support of defending Exelon enterprise and operational technology assets, and other supporting infrastructure, against Advanced Persistent Threats. The CDTIA works closely with Incident Response, Incident Monitoring, Forensics, Systems Engineering, and other cyber security teams to provide security control services to the business. The CDTIA also collaborates with physical and OT security teams to address threats to the nation's critical infrastructure. Note: This is a hybrid position (in-office with remote flexibility). Employees are required to be in office at least three days per week (Tuesday, Wednesday, and Thursday). This role is open to our corporate offices in Chicago/Oakbrook Terrace, IL - Philadelphia, PA - Newark, DE - Baltimore, MD or Washington DC. No relocation is available. You must be able to commute within our service area to be considered. Primary Duties * Serve as a conduit for investigative exchange, starting with internal company data and processes, and correlating with other partner organizations detections (50%) * Develop threat hunting and detection campaigns jointly with partner organizations; use these campaigns, detection methodologies, and general guidance within the corporate environment. (20%) * Support end-to-end intelligence efforts through expert analysis and oral and verbal reporting of threat intelligence and its associated data. (10%) * Support the identification, containment, and eradication of threats of all sophistication levels. (10%) * Recommend short- & long-term adjustments to controls for immediate & future identification, containment & remediation, within corporate and partner organizations. (5%) * Provide direction on tuning of signatures, rules, alerts, parsers, & custom scripts. (5%) Job Scope The Principal Cyber Defense Threat Intelligence Analyst reports to the Manager, Intelligence and Security Analysis ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Enhancing Workload Security in Kubernetes](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Best Paying Jobs in Technology](https://www.wearedevelopers.com/magazine/256-best-paying-jobs-in-technology) - [A Guide to Green Tech and Green IT Careers](https://www.wearedevelopers.com/magazine/374-a-guide-to-green-tech-and-green-it-careers) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [What’s the Difference between a Junior, Mid, and Senior Developer?](https://www.wearedevelopers.com/magazine/238-what-s-the-difference-between-a-junior-mid-and-senior-developer)