> Markdown version of [/jobs/ext/2934910-cyber-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/2934910-cyber-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Intelligence Analyst - **Company:** State Employees' Credit Union - **Location:** Raleigh, NC, United States (Remote available) - **Experience:** Expert - **Salary:** $140,000.0 - $188,000.0 - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Data Analysis, Continuous Integration, Github, Information Technology Operations, Intelligence Analysis, Intrusion Detection and Prevention, Python (Programming Language), Test Data, Software Vulnerability Management, Scripting, Macros, Software Security, Mitre Att&ck, Cyber Threat Analysis, Cybercrime, Splunk, SentinelOne Expertise, Software Version Control - **Published:** September 16, 2026 - **Apply:** https://www.careerjet.com/job/us18d26ef37a48c9abb4fb5f03493e70c8/eaa ## About the Role * 4+ years in cybersecurity with at least 2 years focused on threat intelligence, detection engineering, threat hunting, or SOC analysis. * Strong hands-on Splunk experience: advanced SPL, Splunk Enterprise Security, correlation searches, risk-based alerting, data models, and CIM. * Demonstrated experience building and tuning detections from threat intelligence or adversary emulation. * Working knowledge of MITRE ATT&CK and the ability to apply it to both intelligence analysis and detection coverage. * Solid understanding of attacker tradecraft across endpoint, network, identity, cloud, and email. * Familiarity with vulnerability management data and prioritization frameworks (CVSS, VPR, EPSS, CISA KEV). * Strong analytical writing; able to produce concise intelligence products for audiences ranging from engineers to executives. Preferred * Experience with Tenable, SentinelOne, GitHub Advanced Security, Zscaler, Proofpoint, or comparable platforms. * Scripting in Python for enrichment, automation, or data analysis; familiarity with APIs and STIX/TAXII. * Experience with a threat intelligence platform (TIP) and with structured analytic techniques. * Exposure to CTEM or exposure management platforms. * Experience with detection-as-code practices (version control, testing, CI/CD for detections). * Relevant certifications such as GCTI, GCDA, GCFA, Splunk Core Certified Power User or Enterprise Security Certified Admin, or CySA+. * Background in AI/ML security, software supply chain security, or application security. ## Description If you are motivated and believe in the credit union philosophy of "People Helping People," join our team! You will turn external threat reporting and internal telemetry into actionable intelligence, build and tune detections in Splunk, and help drive the shift from reporting on vulnerabilities toward reducing real exposure. Your analysis directly informs prioritization for the vulnerability management program, the detections that protect the enterprise, and the threat briefings that reach the CISO and executive leadership. This is a hands-on role. You will spend as much time writing SPL and correlation searches as you will reading threat reports, and you will be expected to close the loop between the two. What you will do Threat intelligence and analysis * Collect, analyze, and operationalize threat intelligence from commercial feeds, ISACs, open sources, and vendor advisories. * Track threat actors, campaigns, malware families, and TTPs relevant to our industry, technology stack, and third-party ecosystem, mapping findings to MITRE ATT&CK. * Produce clear, decision-ready intelligence products: tactical indicator packages, operational campaign analysis, and strategic briefings for leadership. * Assess the exploitability and real-world relevance of newly disclosed vulnerabilities (CISA KEV, EPSS, vendor advisories, exploit availability) and feed that assessment into vulnerability prioritization. * Support incident response with threat context, attribution analysis, and indicator enrichment. Detection engineering * Design, build, test, and tune detections in Splunk Enterprise Security, including correlation searches, risk-based alerting (RBA) rules, and notable event logic. * Translate intelligence on adversary TTPs into detection coverage; maintain a coverage map against MITRE ATT&CK and identify gaps. * Write efficient, maintainable SPL; build and maintain lookups, macros, data models, and CIM-compliant normalization for new data sources. * Own the detection lifecycle: hypothesis, development, validation against test data or purple-team exercises, deployment, tuning, and retirement. * Reduce false positives and alert fatigue through measurement and iterative tuning. Threat hunting and exposure management * Conduct hypothesis-driven threat hunts across Splunk and endpoint, network, identity, and cloud telemetry. * Correlate vulnerability data (Tenable) with endpoint (SentinelOne), source control (GitHub), network and edge (F5, Check Point, Zscaler), and email (Proofpoint) telemetry to surface exposed, exploitable, and actively targeted assets. * Contribute to the continuous threat exposure management (CTEM) program by aligning threat intelligence with asset context and business impact. * Support emerging programs in AI security, supply chain / third-party risk, and application security with threat research and detection use cases. Reporting and collaboration * Build and maintain Splunk dashboards and scheduled reports for threat intelligence metrics, detection coverage, and hunt outcomes. * Partner with the Splunk platform team on data onboarding, search performance, and platform changes. * Work closely with vulnerability management, incident response, IT operations, and application owners to drive remediation and detection improvements. * Brief technical and non-technical audiences, including contributions to CISO and governance-level reporting., Job Description: Overview This is a remote role that may be hired in several markets across the United States. As a Senior Incident Response Analyst, you'll be a member of th… + 1 month ago ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Crafting Custom Frameworks with Rust: A Deep Dive into Procedural Macros](https://www.wearedevelopers.com/videos/849-crafting-custom-frameworks-with-rust-a-deep-dive-into-procedural-macros) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems) - [Dev Digest 166: Sycophancy, Zip bombs and AI Native Development](https://www.wearedevelopers.com/magazine/585-dev-digest-166-sycophancy-zip-bombs-and-ai-native-development) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)