Senior CIRT / Threat Intel Analyst

What you'll do

• Coordinate and triage cybersecurity events while conducting forensic analysis across endpoints, networks, cloud, and SaaS environments.
• Integrate threat intelligence into investigations by enriching IOCs and mapping activity to the MITRE ATT&CK framework.
• Develop and operationalize incident response playbooks, SOPs, and priority intelligence requirements.
• Investigate incidents with the SOC to deliver containment, remediation, and root cause analysis.
• Create and tune detections in SIEM and EDR systems using intelligence signals like YARA and Sigma.
• Produce and present intelligence outputs, including flash alerts and executive briefs, for technical and non-technical stakeholders.
• Monitor emerging CVEs and exploit trends to advise on risk-based prioritization.
• Participate in information-sharing activities with industry peers and trust groups in line with legal requirements.

What we're looking for

• 3+ years of information security experience with a focus on incident response, threat hunting, or threat intelligence.
• Working knowledge of common cyber attacks, tools, and attacker tradecraft, including mapping activity to MITRE ATT&CK.
• Demonstrated experience handling security events in critical environments and applying intelligence to accelerate triage and response.
• Experience analyzing system, application, and cloud/SaaS logs to investigate security and operational issues.
• Hands-on experience with a SIEM (Splunk preferred) for investigations, alert creation, reporting, and threat hunting.
• Familiarity with threat intel workflows including collection planning, source evaluation, indicator lifecycle, PIRs, TLP, and feedback loops.
• Experience with one or more TIPs or intel data sources (e.g., MISP, OpenCTI, Recorded Future) and STIX/TAXII concepts.
• Advanced knowledge of network protocols (TCP/IP, HTTP) and operating systems.