SUMMARY: The Cyber Threat Intelligence Engineer Lead provides technical leadership for the collection, analysis, enrichment, and operationalization of CTI to identify and mitigate threats to the organization. This role performs complex analysis of cyber threat actors, campaigns, tactics, techniques, and procedures (TTPs), vulnerabilities, malware, and emerging threats and translates intelligence into actionable defensive measures. This person leads increasingly complex day-to-day Cyber Threat Intelligence activities, partners closely with Security Operations on Incident Response, Threat Hunting, Security Monitoring, Exposure Management, and other related functions, providing intelligence-driven recommendations to strengthen the organization’s security posture.
You must be eligible to work in the US without Visa Sponsorship
JOB DUTIES
Leads complex cyber threat intelligence analysis across multiple security domains, business functions, technologies, and threat environments.
Collects, analyzes, evaluates, and correlates threat intelligence from internal telemetry, commercial intelligence providers, open-source intelligence, government sources, industry information-sharing organizations, and other trusted sources.
Researches and tracks threat actors, malware, campaigns, vulnerabilities, exploits, infrastructure, tactics, techniques, and procedures (TTPs) relevant to the organization and its technology environment.
Develops intelligence products including tactical alerts, threat assessments, intelligence reports, threat actor profiles, vulnerability intelligence, campaign analysis, executive briefings, and strategic threat assessments.
Maps adversary behaviors and observed activity to industry frameworks such as MITRE ATT&CK and uses intelligence to support detection engineering, threat hunting, incident response, and security control improvements.
Operationalizes threat intelligence by developing, enriching, and maintaining indicators, detection opportunities, intelligence requirements, watchlists, threat models, and other intelligence artifacts used by Security Operations teams.
Partners with Security Operations and Detection Engineering teammates to translate threat intelligence into SIEM, EDR, NDR, and other security analytics, detections, and hunting hypotheses.
Supports proactive threat hunting by developing intelligence-driven hypotheses and identifying adversary behaviors, indicators, and attack patterns that warrant investigation within the environment.
Provides threat intelligence support during cybersecurity incidents, including adversary research, infrastructure analysis, indicator enrichment, campaign correlation, and assessment of potential scope and impact.
Analyzes vulnerability and exploit intelligence to help prioritize vulnerabilities and exposures based on observed exploitation, adversary activity, threat relevance, asset exposure, and potential business impact.
Develops and maintains automation, integrations, scripts, APIs, and workflows to improve threat intelligence collection, enrichment, correlation, dissemination, and operationalization across security platforms.
Establishes and maintains intelligence requirements and collection priorities aligned with organizational risks, critical assets, business operations, and the evolving external threat landscape.
Evaluates the effectiveness and relevance of intelligence sources, threat feeds, platforms, tooling, and processes and recommends improvements that increase intelligence quality and defensive value.
Provides technical leadership, guidance, and mentoring to Cyber Threat Intelligence engineers and analysts and promotes consistent intelligence tradecraft, documentation, analytical standards, and operational practices.
Communicates complex technical threat information to technical and non-technical stakeholders and provides clear recommendations for mitigating identified risks.
Identifies opportunities to improve Cyber Threat Intelligence processes,…