CTI Analyst

Calling all innovators - find your future at Fiserv.

We're Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world. We connect financial institutions, corporations, merchants and consumers to one another millions of times a day - quickly, reliably, and securely. Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we're involved. If you want to make an impact on a global scale, come make a difference at Fiserv.

Job Title

Cyber Threat Intelligence Analyst 

Fully on-site  |  Cybersecurity Operations – Cyber Threat Intelligence 

Calling all innovators – find your future at Fiserv. 

We're Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world. We connect financial institutions, corporations, merchants, and consumers to one another millions of times a day – quickly, reliably, and securely. Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we're involved. If you want to make an impact on a global scale, come make a difference at Fiserv. 

About your role: 

Most threat intelligence roles end with a report. This one is built to change what happens next. As a Cyber Threat Intelligence (CTI) Analyst, you'll be a core member of our Cybersecurity Operations team, reporting to our VP of Cyber Threat Intelligence. Your job is to identify, track, and translate emerging cyber threats into intelligence that protects Fiserv's platforms, clients, data, and infrastructure – for a company that moves money and information millions of times a day. 

This is a highly technical CTI seat at the intersection of threat intelligence, incident response, and engineering. You'll work side by side with the SOC, Detection Engineering, Threat Hunting, Attack Surface Management, and Red and Purple Team groups, so your analysis never sits on a shelf – it becomes the detections, hunts, and priorities that come next. If you're naturally curious, love learning new things, and want to explore novel approaches to CTI – including building the tools, models, and platforms that mature a CTI program – this is the seat. 

What you’ll do: 

• Operationalize the intelligence cycle by developing and maintaining intelligence requirements, collection requirements, collection plans, and analytic frameworks, then identifying gaps and refining the process to improve outcomes. 

• Produce strategic, operational, and tactical intelligence – threat assessments, campaign analyses, executive briefings, and operational advisories – that inform stakeholders and shape their decisions. 

• Track the threat actors, campaigns, capabilities, and attack patterns that matter most to Fiserv, and use that awareness to set operational priorities. 

• Partner with the SOC and Detection Engineering teams to turn adversary behavior into detection opportunities and prioritized monitoring. 

• Work with the Threat Hunting team to build hunt hypotheses grounded in observed adversary behaviors and trends. 

• Team up with Attack Surface Management to prioritize vulnerabilities using real intelligence on emerging threats, exploitation trends, and attacker adoption patterns. 

• Support Red and Purple Team exercises by profiling relevant threat actors so testing stays realistic and impactful. 

• Dig into adversary infrastructure – domains, IPs, hosting providers, certificates, and operational patterns – to uncover relationships that support investigations and intelligence production. 

• Help build the CTI program of the future by developing and improving intelligence tools, models, processes, and platforms. 

• Responsibilities listed are not intended to be all-inclusive and may be modified as necessary. 

Experience you’ll need to have: 

• 5+ years of experience in operational or technical cyber threat intelligence; OR 5+ years of experience in threat hunting, counter-adversary operations, incident response, digital forensics, or related cybersecurity disciplines, with demonstrated knowledge of CTI methodologies and practices. 

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field and/or equivalent military or federal experience. 

• Demonstrated ability to apply the intelligence lifecycle, MITRE ATT&CK, cyber kill chain concepts, and adversary TTP analysis to real-world investigations, detections, threat hunts, and intelligence production. 

• Demonstrated ability to conduct threat intelligence analysis, identify attack patterns, develop intelligence assessments, correlate technical indicators, and communicate actionable intelligence to operational and executive stakeholders. 

• Demonstrated ability to evaluate attacker capabilities, assess organizational exposure, and put threats in context for an enterprise environment. 

• Experience using Threat Intelligence Platform (TIP) solutions (e.g., Anomali, OpenCTI) to conduct analysis and support intelligence workflows. 

• Experience working with common CTI providers (e.g., Google Threat Intelligence, Recorded Future, Flashpoint, Silobreaker, CrowdStrike). 

• Experience using security telemetry from network, endpoint, cloud, identity, and/or email security platforms to support analysis, investigations, and threat validation. 

• Strong written communication skills, with the ability to produce clear, concise, relevant intelligence products for a diverse range of stakeholders. 

• Strong verbal briefing skills and comfort presenting threat findings to stakeholders at all levels. 

Experience that would be great to have: 

• Relevant certifications such as GCTI, GCIH, GCFA, or similar. 

• Experience in financial services or other regulated environments. 

• Experience conducting malware triage, behavioral analysis, and technical assessments of the malicious tooling adversaries use. 

• Experience performing infrastructure investigations using passive DNS, WHOIS, certificate transparency, internet scanning, NetFlow, and/or related enrichment sources. 

• Experience using Python, PowerShell, KQL, SPL, or similar technologies to automate workflows. 

• Experience running analytical investigations on large datasets, including enrichment, correlation, visualization, and trend analysis across multiple intelligence and security data sources. 

• Experience using LLMs, agentic workflows, or other AI-enabled technologies to support intelligence collection, processing, analysis, and/or production. 

How you’ll work: 

• We’re better together! This role is fully on-site at either our Berkeley Heights, NJ office OR our Alpharetta, GA office. 

• This is a full-time, direct-hire position. No contract options or unsolicited agency submissions will be considered. 

Sponsorship: 

• You must currently possess valid and unrestricted U.S. work authorization to be considered for this role. Individuals with temporary visas including, but not limited to, F-1 (OPT, CPT, STEM), H-1B, H-2, or TN, or any candidate requiring sponsorship, now or in the future, will not be considered. 

Fiserv is proud to be an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, gender, gender identity, sexual orientation, age, disability, protected veteran status, or any other category protected by law. 

If you have a disability and require a reasonable accommodation in completing a job application or otherwise participating in the overall hiring process, please contact [email protected]. Please note our AskHR representatives do not have visibility to your application status. Current associates who require a workplace accommodation should refer to Fiserv’s Disability Accommodation Policy for additional information. 

Note to agencies: Fiserv does not accept resume submissions from agencies outside of existing agreements. Please do not send resumes to Fiserv associates. Fiserv is not responsible for any fees associated with unsolicited resume submissions. 

Warning about fake job posts: Please be aware of fraudulent job postings that are not affiliated with Fiserv. Fraudulent job postings may be used by cyber criminals to target your personally identifiable information and/or to steal money or financial information. Any communications from a Fiserv representative will come from a legitimate Fiserv email address. 

Salary Range

These pay ranges apply to employees in New Jersey and New York. Pay ranges for employees in other states may differ.

It is unlawful to discriminate against a prospective employee due to the individual's status as a veteran.

Thank you for considering employment with Fiserv.  Please:

• Apply using your legal name
• Complete the step-by-step profile and attach your resume (either is acceptable, both are preferable).

Our commitment to Equal Opportunity:

Fiserv is proud to be an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, gender, gender identity, sexual orientation, age, disability, protected veteran status, or any other category protected by law. 

If you have a disability and require a reasonable accommodation in completing a job application or otherwise participating in the overall hiring process, please contact [email protected]. Please note our AskHR representatives do not have visibility to your application status. Current associates who require a workplace accommodation should refer to Fiserv’s Disability Accommodation Policy for additional information.

Note to agencies:

Fiserv does not accept resume submissions from agencies outside of existing agreements. Please do not send resumes to Fiserv associates. Fiserv is not responsible for any fees associated with unsolicited resume submissions.

Warning about fake job posts:

Please be aware of fraudulent job postings that are not affiliated with Fiserv. Fraudulent job postings may be used by cyber criminals to target your personally identifiable information and/or to steal money or financial information. Any communications from a Fiserv representative will come from a legitimate Fiserv email address.