Cyber Threat Intelligence Engineer Lead - Global Industrial

Description

The company is a global industrial business and this lead role sits within its cyber threat intelligence function.

You will lead the collection, analysis, enrichment and use of threat intelligence to find and reduce threats to the organization.

You will take on increasingly complex day-to-day threat intelligence work and work closely with Security Operations on incident response, threat hunting, security monitoring, exposure management and related areas.

You will turn your analysis into practical defensive recommendations that strengthen the organization's security posture.

You must be eligible to work in the US. Visa sponsorship is not available.

Responsibilities

• Lead complex threat intelligence analysis across several security domains, business functions, technologies and threat environments.
• Collect, analyze, evaluate and correlate intelligence from internal telemetry, commercial providers, open-source material, government sources, industry sharing groups and other trusted sources.
• Research and track threat actors, malware, campaigns, vulnerabilities, exploits, infrastructure and TTPs that matter to the organization's technology environment.
• Produce tactical alerts, threat assessments, intelligence reports, actor profiles, vulnerability intelligence, campaign analysis, executive briefings and strategic assessments.
• Map adversary behavior and observed activity to MITRE ATT&CK and use the results to guide detection engineering, threat hunting, incident response and control improvements.
• Build and maintain indicators, detection opportunities, intelligence requirements, watchlists, threat models and other artifacts that Security Operations relies on.
• Work with Security Operations and Detection Engineering to turn intelligence into SIEM, EDR, NDR and other analytics, detections and hunting hypotheses.
• Develop intelligence-driven hunting hypotheses and identify adversary behaviors, indicators and attack patterns worth investigating in the environment.
• Support incidents with adversary research, infrastructure analysis, indicator enrichment, campaign correlation and assessment of likely scope and impact.
• Analyze vulnerability and exploit intelligence to help rank vulnerabilities by observed exploitation, adversary activity, relevance, asset exposure and business impact.
• Build and maintain automation, integrations, scripts, APIs and workflows that improve how intelligence is collected, enriched, correlated and shared across security platforms.
• Set and maintain intelligence requirements and collection priorities based on organizational risk, critical assets, business operations and the external threat landscape.
• Assess intelligence sources, feeds, platforms, tools and processes, and recommend changes that improve quality and defensive value.
• Lead and mentor threat intelligence engineers and analysts, and set consistent tradecraft, documentation, analytical standards and operating practices.
• Explain complex threat information to technical and non-technical audiences, with clear recommendations for reducing risk.
• Find ways to improve threat intelligence processes, automation, integrations, reporting, metrics and intelligence-driven operations.
• Perform other related duties as assigned.

Requirements

• Bachelor's degree in cybersecurity, computer science, information technology, intelligence studies or a related field, typically with 8-12 years of related cybersecurity experience. Significant experience in threat intelligence, threat hunting, incident response, detection engineering or security operations can stand in for equivalent experience.
• Advanced knowledge of threat intelligence methods, the intelligence lifecycle, collection, structured analysis, actor tracking and dissemination.
• Advanced knowledge of adversary TTPs, attack lifecycles, actor behavior, malware, vulnerabilities, exploits and emerging threats.
• Strong working knowledge of MITRE ATT&CK and its use in intelligence, detection engineering, threat hunting and defensive operations.
• Experience with threat intelligence platforms, SIEM, EDR, NDR, SOAR, vulnerability management platforms and commercial and open-source intelligence sources.
• Understanding of STIX/TAXII, APIs, indicator enrichment, intelligence sharing and automated intelligence workflows.
• Scripting, query or programming skills in Python, PowerShell, KQL, SQL, regular expressions or similar languages for security analysis and automation.
• Strong investigative and analytical skills, including correlating large volumes of security, intelligence, vulnerability and telemetry data to find real threat activity and trends.
• Ability to communicate threats, findings, risk and recommended actions clearly to technical teams, business leaders and senior leadership.
• Ability to manage several intelligence requirements, investigations and priorities at once while meeting operational deadlines.
• Technical leadership and the ability to mentor engineers and analysts, set standards and coordinate intelligence work across cyber defense functions.
• Keeps current with the changing threat landscape, adversary tradecraft, security technology, vulnerabilities, exploits and defensive techniques.
• Careful attention to detail, sound judgment, and a drive to look past initial indicators to understand adversary intent, capability, infrastructure and organizational impact.
• Preferred: GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Incident Handler (GCIH), GIAC Network Forensic Analyst (GNFA), CISSP, or equivalent certifications.

Conditions

Hours, contract type, work location and work model are not stated in the posting.

The company does not discriminate on the basis of sex, race, creed, color, religion, marital status, national origin, citizenship status, age, pregnancy, sexual orientation, gender identity or expression, genetic information, disability, military status, veteran status or any other protected characteristic, and hires and promotes on ability, achievement, experience and conduct.