Cyber Threat Intelligence Analyst

The Senior Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, and disseminating actionable intelligence to support enterprise cybersecurity operations, fraud prevention, and risk mitigation. This role proactively identifies emerging cyber threats, fraud campaigns, dark web activity, insider threats, and brand misuse that could impact organizational assets, personnel, or operations.

The ideal candidate possesses extensive experience conducting cyber threat intelligence analysis, monitoring dark web activity, identifying fraud indicators, and producing operational and executive-level intelligence reporting. This individual will collaborate closely with Security Operations, Incident Response, Threat Hunting, Vulnerability Management, and executive leadership to ensure intelligence is integrated into defensive operations and strategic decision-making.

• Collect, analyze, correlate, enrich, and disseminate actionable cyber threat intelligence from commercial, open-source, government, and proprietary intelligence sources.
• Produce timely intelligence products supporting cybersecurity operations, executive leadership, and mission stakeholders.
• Identify emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and evaluate their potential impact to the organization.
• Maintain threat intelligence processes, workflows, and standard operating procedures to support continuous intelligence operations.

• Monitor dark web forums, marketplaces, messaging platforms, and underground communities for indicators of fraud, credential theft, data leakage, and criminal activity targeting the organization.
• Identify emerging fraud schemes, financial crime trends, phishing campaigns, and identity-based attacks relevant to federal operations.
• Analyze criminal infrastructure and threat actor activity to identify risks before they impact organizational assets.
• Develop intelligence products that help detect, prevent, and mitigate fraud targeting bureau systems, services, and customers.
• Support fraud reporting and intelligence-sharing processes in accordance with Bureau of the Fiscal Service (BFS) requirements and established reporting mechanisms.

• Monitor organizational brands, domains, and digital assets for misuse, impersonation, phishing, counterfeit activity, and unauthorized use.
• Investigate potential brand abuse incidents and recommend mitigation strategies.
• Coordinate with appropriate stakeholders to support brand protection activities, including takedown requests for malicious or unauthorized content.
• Monitor cyber, insider, physical, and environmental threats that could impact enterprise operations.

• Integrate threat intelligence into Security Operations Center (SOC), Incident Response, Threat Hunting, Vulnerability Management, and Security Fusion Center activities.
• Provide intelligence support during cybersecurity investigations and incident response activities.
• Develop actionable recommendations that improve detection capabilities and reduce organizational risk.
• Collaborate with cross-functional teams to improve intelligence-driven security operations.

• Leverage Artificial Intelligence (AI) and automation technologies to improve threat intelligence collection, enrichment, prioritization, and analysis.
• Research emerging AI-enabled threat intelligence platforms and security operations capabilities.
• Evaluate opportunities to automate intelligence workflows using multi-source threat feeds and advanced analytics.
• Provide recommendations on integrating AI into cybersecurity operations while supporting responsible and secure implementation practices.

• Produce technical intelligence reports, executive summaries, threat assessments, and operational briefings.
• Communicate complex threat information to technical and non-technical audiences.
• Develop actionable recommendations based on intelligence findings to improve organizational security posture.
• Support leadership with strategic intelligence products that inform operational and risk-based decisions.

• Bachelor's degree in Cybersecurity, Intelligence Studies, Computer Science, Information Assurance, Criminal Justice, or a related field.
• 5+ years of experience in Cyber Threat Intelligence, Security Operations, Fraud Intelligence, Digital Risk Protection, or Cyber Defense.
• Demonstrated experience conducting dark web investigations and monitoring criminal ecosystems.
• Strong understanding of cyber-enabled fraud, financial crime, phishing campaigns, account takeover, identity theft, and social engineering tactics.
• Experience producing actionable cyber threat intelligence for operational security teams and executive leadership.
• Knowledge of cyber threat frameworks including:
• MITRE ATT&CK
• Cyber Kill Chain
• Diamond Model of Intrusion Analysis
• Experience with commercial threat intelligence platforms, Digital Risk Protection (DRP) solutions, and open-source intelligence (OSINT).
• Familiarity with Security Operations Center (SOC) workflows, incident response processes, and threat hunting methodologies.
• Strong analytical, investigative, and critical thinking skills.
• Excellent written and verbal communication skills.

• GIAC Cyber Threat Intelligence (GCTI)
• GIAC Open Source Intelligence (GOSI)
• Certified Information Systems Security Professional (CISSP)
• Certified Fraud Examiner (CFE)
• SANS FOR578 (Cyber Threat Intelligence) or equivalent training.
• Experience supporting Bureau of the Fiscal Service (BFS), Treasury, or other federal civilian agencies.
• Experience using threat intelligence platforms such as Recorded Future, Anomali, ThreatConnect, Mandiant, Microsoft Defender Threat Intelligence, or similar technologies.
• Familiarity with AI-enabled threat intelligence platforms, automation tools, and machine learning applications for cybersecurity.

• Extensive knowledge of cybercriminal ecosystems, underground marketplaces, dark web communities, and threat actor behaviors.
• Strong understanding of fraud methodologies, financial cybercrime, digital identity abuse, and brand impersonation techniques.
• Ability to identify indicators of compromise (IOCs), indicators of attack (IOAs), and emerging fraud trends.
• Experience correlating intelligence from multiple sources to produce timely, actionable reporting.
• Ability to communicate intelligence findings effectively to cybersecurity teams, investigators, executives, and mission stakeholders.
• Strong investigative mindset with the ability to recognize patterns, anticipate adversary behavior, and proactively identify organizational risks.
• Ability to leverage automation and artificial intelligence to improve intelligence collection, enrichment, and operational effectiveness.