Lead Threat Intelligence Analyst

Lead Threat Intelligence Analyst
Reports to: EVP Global Cyber Operations

As a Lead Threat Intelligence Analyst, you will be instrumental in collecting, analyzing, and disseminating cyber threat intelligence that directly informs and enhances our security awareness, detection, response, and defensive capabilities. You’ll leverage your expertise to process large volumes of cyber threat data, conduct deep-dive analysis, and produce high-quality reports for internal and external stakeholders.This role requires a keen eye for detail, strong analytic tradecraft, and excellent communication skills. You’ll play a key role in shaping intelligence-driven security operations while supporting the broader threat intelligence needs of our clients and internal teams.

In this role, you’ll get to:

• Monitor and evaluate publicly available and closed sources, selecting and reviewing cyber threat reporting for relevance and actionability.
• Analyze processed threat intelligence, correlating and synthesizing findings with other internal and external sources to create a comprehensive threat picture.
• Produce brief, high-impact customer-facing summaries highlighting essential facts for internal sharing, as well as more detailed formal reports that include key facts, technical details, threat actor profiling, victimology, attack chains, and TTPs.
• Recommend mitigation measures based on technical analysis and threat assessments to reduce client risk exposure.
• Identify and map key elements from intelligence reports to STIX threat objects for easy consumption by stakeholders and ingestion into the Threat Intelligence Platform.
• Ingest finalized intelligence reports and supporting data into the Threat Intelligence Platform for knowledge management, correlation, hunting, and alerting, ensuring accessibility for internal teams and clients.
• Collect, process, and analyze dark web activity and data leak site listings, maintaining a comprehensive leak site database to track trends, generate reports, and inform clients.
• Create charts, graphs, and tables to visualize threat actor activity and trends 
• Monitor and respond to threat intelligence requests for information (RFIs) for both internal and customer facing teams.
• Participate in incident event escalations by identifying and actioning leads for intelligence reporting.
• Review and approve email notifications, blog posts, and other customer communications based on finalized threat intelligence reports.
• Provide intelligence-driven support to Security Operations Center, Threat Hunting, Incident Response, and Vulnerability Management teams.
• Brief internal teams, clients, and executive stakeholders on emerging threats, relevant threat actors, and mitigation strategies.
• Mentor junior analysts and contribute to the development of Cyber Threat Intelligence team tradecraft and processes.

To be successful in this role, you’ll need to:

• Be proficient in using Threat Intelligence Platforms (TIPs), such as OpenCTI, and mapping intelligence data to STIX/TAXII frameworks.
• Demonstrate strong analytic skills in processing, correlating, and synthesizing multiple sources of intelligence to produce actionable reports.
• Possess SIEM experience or related/equal experience
• Position and discuss security issues with customer technical and leadership audiences to reach positive outcomes 
• Demonstrate technical writing skills for customer or executive audiences
• Demonstrate proficiency in English; additional languages are a plus.
• Possess a deep understanding of threat actors, their motivations, TTPs (aligned to MITRE ATT&CK), and how they target industries and organizations.
• Leverage Scripting experience
• Preferred Industry-Recognized Certifications:
• GIAC Cyber Threat Intelligence (GCTI), GIAC Reverse Engineering Malware, (SOC)
• EC-Council’s Certified Cyber Intelligence Analyst (CTIA), CREST's Certified Threat Intelligence Manager and CREST Registered Threat Intelligence Analyst, MITRE ATT&CK® Cyber Threat Intelligence Certification. 
• Not required, but prefer some experience with Malware Analysis, Digital Forensics or Incident Response (full packet capture, host/network, email) 

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Statutory Pay Disclosure

The anticipated salary range for this role is $175,00 - $190,000 + bonus + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.