Senior Cyber Threat Intelligence (CTI) Analyst

Key Responsibilities

• Define and maintain priority intelligence requirements (PIRs) aligned with business risk, ensuring each has a named consumer.
• Conduct workshops to keep PIRs current as business needs evolve.
• Map collection sources to PIRs, addressing gaps with relevant intelligence sources, including E-ISAC membership and dark-web coverage.
• Operate and manage the intelligence platform stack (MISP plus commercial feeds), ensuring validation and enrichment of data.
• Produce strategic, operational, and tactical intelligence, adhering to a standard of clarity and actionable recommendations.
• Integrate intelligence into detection engineering, incident response, and enterprise risk reporting.
• Establish and report on CTI metrics to drive continuous improvement.
• Maintain threat profiles and track adversaries relevant to the sectors of energy, mining, and digital assets.

Key Requirements and Technology Experience

• 6+ years in cyber threat intelligence or a closely related cybersecurity role, with experience in building or maturing a CTI program.
• Hands-on experience with at least one major SIEM platform (Microsoft Sentinel preferred) and EDR tooling.
• Proficiency in threat intelligence platforms (MISP preferred; Recorded Future, Mandiant Advantage, or OpenCTI also relevant).
• Strong command of the MITRE ATT&CK framework, mapping TTPs to adversary groups.
• Expertise in the intelligence cycle and PIR-driven production, with the ability to communicate effectively to both technical and executive audiences.
• Knowledge of OSINT and dark-web tradecraft, along with a solid understanding of common attack vectors.
• Calm under pressure with demonstrated discretion in handling sensitive information.
• Certifications such as GCTI, GCIA, GCFE, OSCP, or CISSP.
• Experience in OT and ICS threat intelligence, particularly in the energy sector.
• Scripting skills (Python, PowerShell) for automating CTI and SIEM workflows.
• Familiarity with cloud security (AWS, Azure) and SaaS threat monitoring.
• Background in supporting digital-asset or fintech operations, energy infrastructure, or global supply chains.
• Exposure to converged cyber-physical security operations.