Cyber Threat Intelligence Analyst

• Analyze security data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint detection, and other cybersecurity platforms.
• Identify, track, and assess adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK.
• Correlate threat intelligence with security events to improve detection, triage, threat hunting, and incident response activities.
• Produce actionable intelligence reports, threat briefings, cyber situational awareness products, and adversary assessments for operational stakeholders.
• Develop threat profiles and intelligence products that support security operations and cyber defense decision-making.
• Integrate cyber threat intelligence into daily SOC and incident response workflows.
• Support incident investigations by providing contextual intelligence and adversary attribution where appropriate.
• Collaborate with security engineers, analysts, responders, and leadership to operationalize cyber threat intelligence.
• Identify intelligence gaps and recommend improvements to detection, monitoring, and response capabilities.
• Develop executive and operational dashboards using Splunk, Elastic, or related analytics platforms.
• Create visualizations that communicate emerging threats, attack trends, threat actor activity, and operational metrics.
• Develop and maintain cyber defense playbooks, standard operating procedures (SOPs), and analytical methodologies.
• Document threat hunting processes, incident response procedures, and CTI workflows.
• Assist with automating intelligence collection, enrichment, analysis, and reporting activities.
• Support continuous improvement initiatives that enhance cyber defense operations and mission effectiveness.

This position requires hands-on security operations experience, exceptional analytical skills, and the ability to bridge the gap between cybersecurity operations and threat intelligence. The Cyber Threat Intelligence Analyst will analyze data from SIEM, SOAR, IDS/IPS, network monitoring, and endpoint security platforms, translating findings into actionable intelligence products, threat reporting, dashboards, playbooks, and operational procedures that improve cyber defense capabilities., * Strong analytical, critical-thinking, and problem-solving abilities.

• Experience conducting cyber threat analysis and intelligence production.
• Knowledge of the MITRE ATT&CK framework and adversary TTP analysis.
• Experience developing dashboards, reports, and security visualizations.
• Experience supporting threat hunting, cyber defense, incident response, or security operations activities.
• Experience writing technical documentation, operational playbooks, and standard operating procedures.
• Familiarity with DevSecOps concepts and secure development practices.
• Experience with EDR/XDR technologies and threat intelligence platforms such as MISP, ThreatConnect, Anomali, or Recorded Future.
• Familiarity with Python, PowerShell, or other automation and scripting technologies.
• Experience with cloud security monitoring in AWS, Microsoft Azure, or Google Cloud environments.
• Experience developing security use cases, correlation rules, and detection engineering content.
• Strong written and verbal communication skills.
• Ability to communicate technical findings to both technical and non-technical audiences.
• Experience supporting Intelligence Community, Department of Defense, or Federal cybersecurity environments., * Active TS/SCI clearance with Polygraph is required.
• Three to five or more years of experience supporting a Security Operations Center (SOC), Cyber Defense Team, Cyber Incident Response Team, or similar cybersecurity mission environment.
• Hands-on experience with SIEM, SOAR, IDS/IPS, network monitoring, endpoint security, or related cybersecurity technologies.
• Experience working with Splunk Enterprise Security, Elastic/ELK Stack, or comparable cybersecurity analytics platforms.
• Experience conducting cyber threat analysis and producing actionable intelligence products.
• Strong understanding of adversary tactics, techniques, and procedures (TTPs).
• Experience supporting incident response, cyber defense, or threat hunting activities.
• Experience developing dashboards, reports, and security visualizations.
• Experience writing technical documentation, standard operating procedures, or operational playbooks.
• Strong written and verbal communication skills with the ability to communicate effectively across technical and non-technical audiences.

PREFERRED CERTIFICATIONS:

• GCTI (GIAC Cyber Threat Intelligence)
• CTIA (Certified Threat Intelligence Analyst)
• GCIH (GIAC Certified Incident Handler)
• GCFA (GIAC Certified Forensic Analyst)
• GCIA (GIAC Certified Intrusion Analyst)
• GCED (GIAC Certified Enterprise Defender)
• GMON (GIAC Continuous Monitoring)
• Splunk Enterprise Security Certified Admin
• Splunk Core Power User
• Elastic Certified Analyst
• Elastic Certified Engineer
• CISSP
• Security+
• CySA+