Lead Cyber Intelligence Analyst

McKesson Corporation

Confirmed live today High trust

Hybrid

Quick summary

Work type: Hybrid
Location: Irving, TX
Salary: $151,600–$252,600 / yr
Employment: Full-time
Posted: 20 days ago
Freshness: Confirmed live today
Nearby: 99+ roles within 25 mi

Market check

Salary context

Above market

How this pay compares to similar roles

Similar $152k

This role $202k

$96k $269k

below market most similar roles pay here above market

This role pays more than 87% of similar roles. Most pay $126,362–$177,900 — the blue band above. At the midpoint, this role pays about $202k versus about $152k for comparable roles.

Based on 240 similar postings.

Employer

About McKesson Corporation

McKesson Corporation is a premier American healthcare services company that distributes pharmaceuticals, medical-surgical supplies, and provides technology to the healthcare industry.

McKesson Corporation currently has 137 open roles on FindRole.

Listed pay typically runs $126,000–$210,000 across 77 roles with salary data.

Most-posted roles

View all roles at McKesson Corporation

At a glance

TL;DR · Lead Cyber Intelligence Analyst

Role Posting Log in to save

JOB TITLE: Lead Cyber Intelligence Analyst The Lead Cyber Intelligence Analyst serves as a senior intelligence leader within the cybersecurity team, responsible for identifying and communicating cyber threats affecting business operations and the healthcare sector. This role involves identifying untracked adversary activity, developing threat clusters, and authoring actor profiles for the CIRT, Red Team, and Detection Engineering teams. Key responsibilities include mentoring analysts, performing attribution, and leveraging AI to automate intel-to-detection pipelines. The position requires proficiency with open-source research tools like VirusTotal, Censys, and Grey Noise, alongside experience mining SIEM, EDR, NDR, and cloud logging data. Candidates must apply frameworks like MITRE ATT&CK and Cyber Kill Chain to structure analysis. The work focuses on shifting the organization from being intelligence consumers to producers by developing telemetry-to-intelligence models.

Skills

Cyber Threat Intelligence MITRE ATT&CK SIEM EDR NDR OSINT Virus Total Censys Grey Noise Domain Tools Scripting Automation AI Cyber Kill Chain

What you'll do

Identify and track emerging threats by discovering untracked adversary activity and developing new threat clusters.
Deliver time-sensitive behavioral attack chains to support active incident response and threat hunting operations.
Lead attribution and threat actor analysis by collecting, modeling, and documenting intelligence gathered during investigations.
Author actor profiles for the CIRT, Red Team, Threat Hunt, and Detection Engineering teams.
Leverage AI to automate investigations, infrastructure clustering, and cross-actor TTP analysis.
Provide technical mentorship to mid-level analysts on tradecraft, source evaluation, and production standards.
Represent the intelligence function in cross-functional planning with SOC, threat hunting, and incident response teams.
Contribute to strategic planning on how internal telemetry investments map to intelligence production goals.

What we're looking for

10+ years of experience in cybersecurity, information security, cyber threat intelligence, or threat research.
Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, or a related field.
Experience developing a telemetry-to-intelligence model to reduce reliance on third-party feeds and vendors.
Experience using open source research tools such as Virus Total, Domain Tools, Censys, and Grey Noise.
Experience identifying IOCs and behavioral fingerprints across endpoint, network, cloud, and identity telemetry.
Experience mining SIEM, EDR, NDR, firewall, DNS, proxy, and cloud logging data to identify adversary tradecraft.
Experience using MITRE ATT&CK, Cyber Kill Chain, or similar frameworks to structure threat analysis.
Experience with threat intelligence platforms, link analysis, data enrichment, or scripting and automation (preferred).

Save