> Markdown version of [/jobs/ext/737495-cyber-threat-intelligence-analyst-remote](https://www.wearedevelopers.com/jobs/ext/737495-cyber-threat-intelligence-analyst-remote). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Threat Intelligence Analyst - Remote - **Company:** CSAA Insurance Group - **Location:** Phoenix, AZ, United States (Remote available) - **Experience:** Expert - **Salary:** $122,850.0 - $164,000.0 - **Contract:** Permanent contract - **Skills:** Cyber Security, Computer Telephony Integration, Intrusion Detection and Prevention, Open Source Intelligence, Security Information and Event Management, Mitre Att&ck, Cyber Threat Analysis, Information Technology, Cybercrime, Security Orchestration, Automation & Response - **Published:** June 29, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=76a0fc6a0acf62f7 ## About the Role Do you have experience in Threat intelligence?, Do you have a Bachelor's degree?, * 6+ years of experience in Cyber Threat Intelligence, SOC, Incident Response, Threat Hunting, or related cybersecurity roles * Bachelor's degree in computer science, Information Technology, or a related field, or an equivalent combination of education and experience * Deep experience operating and optimizing industry leading Threat Intelligence Platforms (TIPs) * Proven experience leveraging commercial threat intelligence providers such as Flashpoint, Recorded Future, Intel 471, ZeroFox, or comparable services to support operational intelligence requirements * Strong mastery of the intelligence lifecycle, with demonstrated ability to operationalize intelligence from collection through dissemination and action * Advanced working knowledge of the MITRE ATT&CK framework, with experience applying it to threat analysis, detection engineering, and reporting * Demonstrated experience managing and enriching IOCs, with a focus on translating intelligence into measurable detection, blocking, and mitigation outcomes * Solid understanding of SIEM, SOAR, EDR, and case management platforms, and how intelligence integrates into and enhances investigative workflows * Experience analyzing vulnerability and exploit intelligence to assess real-world risk, likelihood of exploitation, and potential business impact * Strong written and verbal communication skills, with the ability to clearly articulate complex threat and risk concepts to both technical and non-technical stakeholders What would make us excited about you? * A teammate who values collaboration and knowledge sharing * Ability to think critically and operate effectively in ambiguous or evolving situations * Strong communication skills * A strong passion for continuous learning, with curiosity to stay current on emerging threats, techniques, and evolving security trends * A self-starter who takes initiative, operates effectively with minimal direction, and proactively sees opportunities to improve security outcomes * Actively shapes our company culture (e.g., participating in employee resource groups, volunteering, etc.) * Lives into cultural norms (e.g., willing to have cameras when it matters: helping onboard new team members, building relationships, etc.) * Travels as needed for role, including divisional / team meetings and other in-person meetings * Fulfills business needs, which may include investing extra time, helping other teams, etc ## Description Your Role: We are seeking an experienced Cyber Threat Intelligence (CTI) Analyst to help mature the CSAA CTI program. This hands-on role focuses on operationalizing the Threat Intelligence Platform (TIP), tracking priority threats, and delivering actionable, detection-driven intelligence to security teams and leadership. The ideal person is a well-rounded security professional who is comfortable working across teams, proactively identifying risk, and translating intelligence into prevention, detection, and response actions. Your Work: The CSAA Cyber Threat Intelligence Team is responsible for identifying, analyzing, and tracking cyber threats that may impact the organization. We collect intelligence from a wide range of internal and external sources and use that information to understand threat actors, campaigns, vulnerabilities, and attacker tradecraft relevant to our environment. The successful candidate will be responsible for analyzing and contextualizing threat intelligence, identifying potential risks, and supporting security operations through actionable insights. They will help improve insight into emerging threats, support investigative efforts, and contribute to the continued development and maturity of the CTI program. * Monitor and analyze intelligence from commercial, industry, and OSINT sources to track threat actors, campaigns, and vulnerabilities, and assess their relevance, impact, and risk to the organization * Maintain and use Threat Intelligence Platforms (TIP) and related tools to support intelligence operations, including ingestion, enrichment, tagging, and data quality * Integrate intelligence across security tools (SIEM, SOAR, case management) to support operations * Collect, enrich, and manage actionable IOCs to drive detection, blocking, and mitigation efforts across security operations * Provide real-time intelligence context during investigations and incidents (e.g., adversary behavior, infrastructure, objectives) * Analyze vulnerability intelligence, including KEV listings and active exploitation trends, to support risk-based vulnerability prioritization * Respond to ad hoc and time-sensitive intelligence requests from stakeholders * Support threat hunting by developing indicators, behaviors, and hypotheses * Produce and deliver intelligence reports and briefings for technical and non-technical audiences * Improve intelligence workflows, intake processes, RFIs, and documentation, Sustainability: As climate change leads to more frequent and severe weather events, we are taking bold action to build more resilient communities and reduce our environmental impact. Submit your application to be considered. We communicate via email, so check your inbox and/or your spam folder to ensure you don't miss important updates from us., If you apply and are selected to continue in the recruiting process, we will schedule a preliminary call with you to discuss the role and will disclose during that call the available salary/hourly rate range based on your location. Factors used to determine the actual salary offered may include location, experience, or education. ## Related Videos - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)