We're looking for a sharp, driven Intelligence Lead Analyst to join a team that doesn't just analyze intelligence — it builds the tools that collect it.
In this senior-level role, you'll take ownership of maintaining and enhancing our link analysis frameworks while engineering in-house solutions to automate intelligence collection at scale. Your work will directly shape how we identify, pursue, and neutralize threats across one of the world's largest financial institutions.
This role is fundamentally about two things: Cyber OSINT mastery and technical innovation. If you thrive at the intersection of intelligence analysis and software development, this is your opportunity.
CSIS Intelligence Advanced Analytics and Cyber OSINT — Program Description
Citi Security and Investigative Services (CSIS) is a full-service security and investigative team that protects the assets, integrity, and reputation of Citi and its clients as the industry-leading provider of security, investigations, and intelligence. The CSIS Advanced Analytics and Cyber OSINT program delivers timely, actionable intelligence to Citi stakeholders through collection and analysis using both open-source and internal data sources, supporting complex financial crime investigations, cyber-enabled fraud matters, and high-risk security events. The program drives efficiencies through the creation, integration, and deployment of custom analytical tools and intelligence capabilities into the hands of analysts and investigators across the enterprise.
Job Description:
The Intelligence Senior Analyst is an senior-level position responsible for collection/analysis of IoCs and TTPs, maintaining and updating existing link analysis frameworks while also developing in-house solutions to automate intelligence collection. The primary objective of this role is to leverage Open Source Intelligence (OSINT) and development skills to build and operate advanced intelligence capabilities. While familiarity with the cyber domain is welcome, the core focus is on OSINT analysis and the creation of automated collection tools.
Responsibilities:
Fulfill cyber OSINT requests by applying advanced analysis tools and techniques to surface timely, actionable intelligence.
Proactively anticipate gaps in our intelligence posture and develop innovative solutions, collaborating with internal and external stakeholders on open-source methodologies and tooling.
Design (develop), implement, and maintain in-house solutions for collecting, processing, and analyzing open source data.
Automate intelligence collection capabilities, leveraging existing link analysis frameworks and actively identifying and evaluating alternative solution providers.
Apply in-depth disciplinary knowledge to triage, process, and analyze intelligence alerts, reports, and briefings.
Engage in liaison activities with developers, intelligence communities, law enforcement, industry partners, peer financial institutions, and information sharing communities.
Manage multiple projects simultaneously with a proactive, self-motivated approach, ensuring timely delivery of high-quality results while collaborating effectively with global teams.
Complete the daily operational components of the intelligence mission.
Assume an informal/formal mentor role within teams and assist with the coaching and training of new team members.
Qualifications:
6-10 years of relevant experience
Should have a working knowledge in one or more of the following areas: Advanced Persistent Threat, Third Party Risks/Threats, Cybercrime, Extremist Groups and Cyber Terrorists, Hacktivism, Distributed Denial of Service attacks, Fraud, Malware, Mobile Threats
Proven track record of operationalizing cyber threat intelligence — translating raw intelligence into detections, hunt packages, and risk-relevant reporting.
Consistently demonstrates clear and concise written and verbal communication
Proven influencing and relationship management skills
Proven analytical skills
Education:
Bachelor’s degree/University degree or equivalent experience
Master’s degree preferred (Advanced degree preferred, ideally in Computer Science, Cybersecurity, Information Security, or a related STEM discipline)
Additional valued certifications include: CREST CCTIM, Recorded Future Certified Analyst, CISSP, CEH, or OSCP.
Required Skills:
Proficiency in the MITRE ATT&CK framework — mapping adversary TTPs, building hunt hypotheses, and driving detection coverage analysis.
Hands-on experience with Threat Intelligence Platforms including Recorded Future, Mandiant Advantage, ThreatConnect, MISP, or OpenCTI.
Experience with scripting and automation languages including Python, PowerShell, and Bash for intelligence collection, enrichment pipelines, and hunt tooling development.
Advanced OSINT tradecraft including dark web monitoring, social media intelligence, infrastructure pivoting, and digital footprint analysis.
Experience with link analysis platforms such as Palantir, Maltego, and i2 Analyst's Notebook, including building custom extractors, web scrapers, and automation workflows to support investigative and analytical tasks.
Solid understanding of network forensics, log analysis, and reverse engineering in support of hunt operations.
Working knowledge of malware analysis (static and dynamic) and adversary infrastructure analysis.
Exceptional written and verbal communication skills with the ability to produce intelligence products for both technical and executive audiences, consistently demonstrating clarity, conciseness, and attention to detail.
Proven influencing, relationship management, and analytical skills with a track record of driving outcomes across cross-functional teams.
This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.
#LI-EL1
------------------------------------------------------
Job Family Group: Technology------------------------------------------------------
Job Family:Information Security------------------------------------------------------
Time Type:Full time------------------------------------------------------
Primary Location:NC-CHARLOTTE (BALLANTYNE)------------------------------------------------------
Primary Location Full Time Salary Range:$117,440.00 - $176,160.00
In addition to salary, Citi’s offerings may also include, for eligible employees, discretionary and formulaic incentive and retention awards. Citi offers competitive employee benefits, including: medical, dental & vision coverage; 401(k); life, accident, and disability insurance; and wellness programs. Citi also offers paid time off packages, including planned time off (vacation), unplanned time off (sick leave), and paid holidays. For additional information regarding Citi employee benefits, please visit citibenefits.com. Available offerings may vary by jurisdiction, job level, and date of hire.
------------------------------------------------------
Most Relevant Skills Please see the requirements listed above.------------------------------------------------------
Other Relevant Skills For complementary skills, please see above and/or contact the recruiter.------------------------------------------------------
Anticipated Posting Close Date:Sep 02, 2026------------------------------------------------------
Automated Processing and AIWe use automated processing, including artificial intelligence, for our legitimate business interests (or our reasonable and appropriate business purposes) to identify and align the candidate's skills and abilities with a specific job opening. Additionally, if you so choose, or consent, we can match your skills and abilities to other suitable roles at Citi.
Importantly, all our hiring processes and decisions, including determining your suitability for a role, are conducted, checked, and decided by individuals. Our automated processing and AI do not involve relying on automatic or autonomous decision-making. Please refer to any Jurisdictional Considerations, with specific provisions for your country (where relevant) for further details.
Illinois residents – AI Notice and Right
------------------------------------------------------
Citi is an equal opportunity employer, and qualified candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other characteristic protected by law.
If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi.
View Citi’s EEO Policy Statement and the Know Your Rights poster.
Skills Required
- 6-10 years of relevant experience
- Working knowledge of advanced persistent threats, third-party risks, cybercrime, extremist groups, hacktivism, DDoS attacks, fraud, malware, or mobile threats
- Experience operationalizing cyber threat intelligence into detections, hunt packages, and risk-relevant reporting
- Bachelor's degree or equivalent experience
- Proficiency with the MITRE ATT&CK framework, including adversary TTP mapping, hunt hypotheses, and detection coverage analysis
- Hands-on experience with threat intelligence platforms such as Recorded Future, Mandiant Advantage, ThreatConnect, MISP, or OpenCTI
- Experience using Python, PowerShell, and Bash for intelligence collection, enrichment pipelines, and hunt tooling
- Advanced OSINT tradecraft, including dark web monitoring, social media intelligence, infrastructure pivoting, and digital footprint analysis
- Experience with link analysis platforms such as Palantir, Maltego, and i2 Analyst's Notebook
- Experience building custom extractors, web scrapers, and automation workflows
- Understanding of network forensics, log analysis, and reverse engineering
- Working knowledge of static and dynamic malware analysis and adversary infrastructure analysis
- Clear written and verbal communication, analytical skills, influencing skills, and relationship management
- Master's degree, ideally in computer science, cybersecurity, information security, or a related STEM discipline
- CREST CCTIM, Recorded Future Certified Analyst, CISSP, CEH, or OSCP certification
Citi Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Citi and has not been reviewed or approved by Citi.
-
Healthcare Strength — Health coverage is presented as comprehensive, including free in-network preventive care, mental-health resources, and the Be Well Program. Materials also state new hires have access to health and insurance benefits from the outset.
-
Retirement Support — The retirement plan offers a $1-for-$1 match up to 6% of eligible pay. New employees are eligible for the plan, with automatic enrollment after 90 days if they do not enroll themselves.
-
Inclusive Benefits Coverage — Benefits highlight fertility treatment coverage, adoption/surrogacy reimbursement up to $30,000, and disability coverage. Coverage extends to spouses and domestic partners regardless of gender identity or sexuality, with gender-affirming care-related support noted.
Citi Insights
What We Do
Citi's mission is to serve as a trusted partner to our clients by responsibly providing financial services that enable growth and economic progress. Our core activities are safeguarding assets, lending money, making payments and accessing the capital markets on behalf of our clients. We have 200 years of experience helping our clients meet the world's toughest challenges and embrace its greatest opportunities. We are Citi, the global bank – an institution connecting millions of people across hundreds of countries and cities.
