> Markdown version of [/jobs/ext/4049566-cyber-threat-intelligence-analyst](https://www.wearedevelopers.com/jobs/ext/4049566-cyber-threat-intelligence-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cyber Threat Intelligence Analyst

- **Company:** Andersen Software
- **Location:** Austria
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Computer Telephony Integration, Data Cleansing, Python (Programming Language), Open Source Intelligence, Anti-Phishing, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis
- **Published:** October 5, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=7d469310d30a2a70

## About the Role

* Experience in cybersecurity for 5+ years, including 3+ years in a dedicated CTI role.
 * Hands-on work with a threat intelligence platform (e.g. MISP, OpenCTI, ThreatConnect, Anomali, Recorded Future).
 * Strong command of MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain.
 * Experience conducting OSINT research and analysis of malware and phishing campaigns at indicator and TTP level.
 * Experience turning intelligence into detections together with a SOC or SIEM team.
 * Clean professional records and willingness to undergo background verification.
 * Level of English - from Upper-Intermediate and above.

Desired skills

 * Certifications: GCTI, CTIA, GCIH.
 * Experience with STIX/TAXII, YARA and Sigma.
 * Experience in a public sector, international organization, NGO or financial sector environment.
 * Skills scripting in Python for automation and data enrichment.
 * Additional languages (French, Spanish, Arabic, Russian, Chinese).

## Description

* Collecting, analyzing and correlating threat intelligence from open, commercial and community sources (OSINT, ISACs, vendor feeds).
 * Tracking threat actors, campaigns and TTPs relevant to international organizations, including state-sponsored groups.
 * Producing strategic, operational and tactical intelligence reports and briefings for technical and management audiences.
 * Mapping threats to MITRE ATT&CK and turning intelligence into detection use cases together with SOC and SIEM teams.
 * Managing IOCs and their lifecycle in the TIP and enriching SOC alerts and incident investigations.
 * Supporting incident response with actor attribution and context.
 * Sharing intelligence with partner organizations under agreed sharing protocols (TLP).