cyber threat analyst

Cherokee Federal

<div><div><div><b>Cyber Threat Analyst (Intermediate)<br>
</b></div></div><div></div><div><div>This position requires an active<b>Public Trust</b>clearance or the ability to obtain a <b>Public </b><b>Trust</b>clearance to be considered.<br>
</div></div><div></div><div><div>Cherokee Nation System Solutions, LLC is seeking a knowledgeable <b>Security Analyst, Journeyman </b>to join our cybersecurity team and support the organization&rsquo;s efforts to protect data and networks from unauthorized access. The Security Analyst will provide technical expertise in information security standards, monitor network activity for potential threats, and perform in-depth security event analysis. This role requires advanced knowledge of network protocols, firewalls, disaster recovery operations, and security best practices. The ideal candidate will be proactive in identifying threats and solving complex technical issues to enhance the organization&rsquo;s overall security posture.<br>
</div></div><div></div><div><div><b>Compensation &amp; Benefits:
</b></div></div><div><div><div>Estimated Starting Salary Range for<b>Cyber Threat Analyst (Intermediate)</b>: $107K-$115K
</div></div><div><div>Pay commensurate with experience.
</div></div><div><div>Full time benefits include Medical, Dental, Vision, 401K, and other possible benefits as provided. Benefits are subject to change with or without notice.<br>
</div></div><div></div><div><div><b>Cyber Threat Analyst (Intermediate)</b><b>Responsibilities Include:
</b></div></div><div><div>Incident Detection &amp; Response
</div></div><div><ul><li><div>Monitor, analyze, and triage security alerts from multiple sources including SIEM, EDR/XDR, and network monitoring tools
</div></li></ul></div><div><ul><li><div>Perform in-depth investigations of security incidents, including malware, phishing, lateral movement, and data exfiltration
</div></li></ul></div><div><ul><li><div>Lead incident response activities and recommend containment, eradication, and recovery actions
</div></li></ul></div><div><ul><li><div>Create incident reports documenting incident timelines, root cause analysis, and remediation recommendations
</div></li></ul></div><div><div>Endpoint &amp; Network Security Analysis
</div></div><div><ul><li><div>Analyze endpoint telemetry to identify suspicious behavior, persistence mechanisms, and exploitation techniques
</div></li></ul></div><div><ul><li><div>Investigate network traffic (e.g., DNS, HTTP(S), NetFlow, PCAP) for indicators of compromise (IOCs) and attacker activity
</div></li></ul></div><div><ul><li><div>Correlate endpoint and network data to identify threats and attack patterns
</div></li></ul></div><div><div>Cloud Security (AWS &amp; Azure)
</div></div><div><ul><li><div>Monitor and investigate security events in AWS and Azure environments
</div></li></ul></div><div><ul><li><div>Analyze CloudTrail, VPC flow, Azure Activity, and Azure AD/Entra ID logs to identify suspicious cloud activity
</div></li></ul></div><div><ul><li><div>Support cloud incident response and recommend security improvements
</div></li></ul></div><div><div>EDR and SIEM Detection &amp; Analysis
</div></div><div><ul><li><div>Utilize Splunk for log analysis, correlation searches, and dashboard creation
</div></li></ul></div></div><div><div><ul><li><div>Leverage Microsoft Defender XDR and Trellix Endpoint Security (HX) for threat hunting, alert triage, and response actions
</div></li></ul></div><div><ul><li><div>Develop and tune detection rules to improve alert fidelity and reduce false positives
</div></li></ul></div><div><ul><li><div>Create and maintain runbooks and standard operating procedures (SOPs)
</div></li></ul></div><div><div>Threat Hunting &amp; Intelligence
</div></div><div><ul><li><div>Conduct proactive threat hunting across endpoint, network, and cloud environments
</div></li></ul></div><div><ul><li><div>Integrate and apply threat intelligence to enhance detection and response capabilities
</div></li></ul></div><div><ul><li><div>Identify gaps in visibility and recommend improvements
</div></li></ul></div><div><div>Collaboration &amp; Mentorship
</div></div><div><ul><li><div>Act as escalation point for Tier 1 analysts
</div></li></ul></div><div><ul><li><div>Provide guidance and training to junior analysts
</div></li></ul></div><div><ul><li><div>Collaborate with to facilitate incident response and improve security posture<br>
</div></li></ul></div><div></div><div><div><b>Cyber Threat Analyst (Intermediate)</b><b>Experience, Education, Skills, Abilities requested:
</b></div></div><div><ul><li><div><b>Bachelor&rsquo;s degree </b>in Cybersecurity, Information Technology, Computer Science, or a related field is preferred.
</div></li></ul></div><div><ul><li><div>Minimum <b>3-5 years of experience </b>in security analysis, with a strong understanding of network protocols, traffic analysis, endpoint forensics and artifacts.
</div></li></ul></div><div><ul><li><div>Strong experience with Splunk (SPL, dashboards, correlation rules)
</div></li></ul></div><div><ul><li><div>correlation)
</div></li></ul></div><div><ul><li><div>Experience analyzing:
</div></li></ul></div><div><ul><li><div>Endpoint telemetry (EDR tools, host-based investigations)
</div></li></ul></div><div><ul><li><div>Network traffic (packet analysis, NetFlow, IDS/IPS alerts)
</div></li></ul></div></div><div><div><ul><li><div>Cloud logs (AWS and Azure)
</div></li></ul></div><div><ul><li><div>Familiarity with AWS (e.g., CloudTrail, GuardDuty , VPC logs)
</div></li></ul></div><div><ul><li><div>Familiarity with Microsoft Azure (e.g., Azure AD/Entra ID, Defender for Cloud)
</div></li></ul></div><div><ul><li><div>Experience with Microsoft Defender XDR (endpoint, identity, email, and cloud)
</div></li></ul></div><div><ul><li><div>Solid understanding of:
</div></li></ul></div><div><ul><li><div>MITRE ATT&amp;CK framework
</div></li></ul></div><div><ul><li><div>Common attack Tactics, Techniques, and Procedures (TTPs)<br>
</div></li></ul></div><div></div><div><ul><li><div><b>Relevant certifications:
</b></div></li></ul></div><div><ul><li><div>GIAC Certified Incident Handler (GCIH)
</div></li></ul></div><div><ul><li><div>GIAC Certified Forensic Analyst (GCFA)
</div></li></ul></div><div><ul><li><div>GIAC Certified Forensic Analyst (GCFE)
</div></li></ul></div><div><ul><li><div>CompTIA CySA +
</div></li></ul></div><div><ul><li><div>Microsoft Certified: Security Operations Analyst Associate (SC-200)
</div></li></ul></div><div><ul><li><div>Splunk Core Certified Power User
</div></li></ul></div><div><ul><li><div>Splunk Certified Cybersecurity Defense Analyst
</div></li></ul></div><div><ul><li><div><b>Preferred Skills:
</b></div></li></ul></div><div><ul><li><div>Experience with <b>SIEM tools </b>and network monitoring systems.
</div></li></ul></div><div><ul><li><div>Strong analytical and problem-solving skills with the ability to respond to complex security incidents.
</div></li></ul></div><div><ul><li><div>Scripting or automation skills (Python, PowerShell, Bash)
</div></li></ul></div></div><div><div><ul><li><div>Experience with SOAR platforms and automated response workflows
</div></li></ul></div><div><ul><li><div>Knowledge of digital forensics and malware analysis (basic to intermediate)
</div></li></ul></div><div><ul><li><div>Excellent communication skills, with the ability to clearly explain security issues and recommendations to technical and non-technical stakeholders.
</div></li></ul></div><div><ul><li><div>Must pass pre-employment qualifications of Cherokee Federal<br>
</div></li></ul></div><div></div><div><div><b>Company Information:
</b></div></div><div><div><b>Cherokee Nation System Solutions (CNSS)</b>is a part of Cherokee Federal &ndash; the division of tribally owned federal contracting companies owned by Cherokee Nation Businesses. As a trusted partner for more than 60 federal clients, Cherokee Federal LLCs are focused on building a brighter future, solving complex challenges, and <b>serving </b>the government&rsquo;s mission with compassion and heart. To learn more about<b>CNSS</b>, visit cherokee-federal.com.<br>
</div></div><div></div><div><div><b>#CherokeeFederal #LI-SM2 #AppC<br>
</b></div></div><div></div><div><div>Cherokee Federal is a military friendly employer. Veterans and active military transitioning to civilian status are encouraged to apply.
 </div></div><div><div><b>Keywords
</b></div></div><div><div><ul><li><div>Security Analyst
</div></li></ul></div></div><div><div><ul><li><div>Network Security
</div></li></ul></div></div><div><div><ul><li><div>Threat Detection
</div></li></ul></div></div><div><div><ul><li><div>SIEM Tools
</div></li></ul></div></div><div><div><ul><li><div>Incident Response
</div></li></ul><ul><li><div><b>Similar Job Titles
</b></div></li></ul></div></div></div><div><div><div><ul><li><div>Cybersecurity Analyst
</div></li></ul></div></div><div><div><ul><li><div>Network Security Analyst
</div></li></ul></div></div><div><div><ul><li><div>Information Security Specialist
</div></li></ul></div></div><div><div><ul><li><div>Threat Detection Specialist
</div></li></ul></div></div><div><div><ul><li><div>Incident Response Analyst<br>
</div></li></ul></div></div><div></div><div><div><b>Legal Disclaimer: </b>Cherokee Federal is an equal opportunity employer. Please visit cherokee-federal.com/careers for information regarding our Affirmative Action and Equal Opportunity Employer Statement, and Accommodation request.
</div></div><div><div>Many of our job openings require access to government buildings or military installations. Candidates must pass pre-employment qualifications of Cherokee Federal.</div></div></div></div>

Cyber Threat Analyst(Intermediate)

State of Utah

<div>
 <strong>
  FT / PT Status &ndash;
 </strong>
 Full-Time
 <strong>
  Salary &ndash;
 </strong>
 $35.00 - $35.00 Hourly Wage
 <strong>
  Remote Work / In-Office &ndash;
 </strong>
 Hybrid
 <strong>
  Recruiter &ndash;
 </strong>
 Laura Alexander | LAlexander@utah.gov | 801-903-3138
 <strong>
  Application Deadline &ndash;
 </strong>
 4/21/2026
 <br/>
 <br/>
 <strong>
  Cyber Threat Intelligence Analyst- SIAC
  <br/>
  <br/>
 </strong>
 Are you looking for a career in the information security and criminal justice field? The Utah Statewide Information &amp; Analysis Center (SIAC) is an amazing step on your career path. You'll be able to provide assistance to the citizens of Utah and make a difference in our communities.
 <br/>
 <br/>
 Serve as a Cyber Threat Intelligence Analyst with specialties in strategic intelligence production, technical analysis, cyber threat hunting, and/or cyber outreach coordination. Conduct research regarding threat groups and evaluate intelligence on criminal tactics, techniques, and procedures. Analyze events to determine the impact on current operations and conduct research to determine adversary capability and intent. This may include giving and producing intelligence briefings, training, presentations, and organizing collaborative groups and outreach programs. Conduct outreach to increase security awareness and notification of specific threats. Cyber Threat Intelligence Analysts perform entry level Information Security related duties in the areas of cybersecurity.
 <br/>
 <br/>
 <strong>
  As a Cyber Threat Intelligence Analyst, You Will
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Collect and document raw information for further analysis and evaluation.
  </li>
  <li>
   Assess and analyze cyber threats and vulnerabilities and disseminate intelligence reports to stakeholders.
  </li>
  <li>
   Assist law enforcement with network analysis and criminal investigations.
  </li>
  <li>
   Coordinate and participate in necessary outreach to law enforcement, public and private sector, and cybersecurity professionals.
  </li>
  <li>
   Perform statistical and intelligence analysis by applying analytical tradecraft and best practices in analyzing data and reaching accurate conclusions.
  </li>
  <li>
   Analyze, summarize and/or review data; report findings, interpret results and/or make recommendations.
  </li>
  <li>
   Write or draft raw and finished intelligence reports, articles or related material based on research, investigation or analysis.
  </li>
  <li>
   Form conclusions and develop recommendations for detection, deterrence, disruption and mitigation.
  </li>
  <li>
   Participate in community working groups or teams or other related assignments as needed/directed.
  </li>
  <li>
   Ensure the integrity and protection of networks, systems, and applications through cyber threat and network monitoring, performing on-demand vulnerability assessments, and investigations and reporting of incidents.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Qualifications
  <br/>
  <br/>
 </strong>
 <strong>
  Ideal Candidate:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Demonstrated skill in intelligence analysis and critical thinking
  </li>
  <li>
   Demonstrated skill in social media research and analysis
  </li>
  <li>
   Working level experience in the use of databases for entering data, searching and exploiting information and the development of intelligence to inform decision makers,
  </li>
  <li>
   Working level skills in spreadsheets, statistics, and Microsoft Office Suite
  </li>
  <li>
   Working level analytic report writing and presentations skills
  </li>
  <li>
   Demonstrated experience in security operations (SIEMs), network monitoring, and vulnerability management platforms (Tenable, Nessus, etc.)
  </li>
  <li>
   Knowledge of malware analysis concepts, methods, and techniques
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Preference May Be Given To Applicants Who Currently
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Have SECRET National Security Clearance and have experience with Intelligence Analysis, Targeting, Information Security
  </li>
  <li>
   Have experience working on task forces or similar environments
  </li>
  <li>
   Have industry-recognized cybersecurity-related certifications (GIAC, CompTIA, etc.)
  </li>
  <li>
   Are a DPS employee
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Additional Information
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   This position requires the successful candidate to be willing and available to travel both in state and out of state, including overnight stays when necessary.
  </li>
  <li>
   A level II background will be completed on candidates who accept a verbal, conditional offer.
  </li>
  <li>
   What does it mean to qualify to hold a security clearance? Please visit- https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-147
  </li>
  <li>
   Attend Subject Matter Expertise development training for this position.
  </li>
  <li>
   Completion of SECRET National Security Clearance submission packet (if clearance is not currently held by successful candidate).
  </li>
  <li>
   Only candidates selected for an interview will be contacted
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  About The Role
  <br/>
  <br/>
 </strong>
 <strong>
  Location
 </strong>
 &ndash;
 <br/>
 <br/>
 4501 S 2700 W, Po Box 148285
 <br/>
 <br/>
 Salt Lake City, Utah, 84114-8285
 <br/>
 <br/>
 United States
 <br/>
 <br/>
 <strong>
  Background Check Required
 </strong>
 &ndash; You must successfully pass a criminal history check.
 <br/>
 <br/>
 <strong>
  Drug Test Required
 </strong>
 &ndash; No
 <br/>
 <br/>
 <strong>
  Schedule Code
 </strong>
 &ndash; B - Competitive Career Service
 <br/>
 <br/>
 <strong>
  Why You Should Join Our Team
  <br/>
  <br/>
 </strong>
 <strong>
  Benefits
  <br/>
  <br/>
 </strong>
 In Utah, we believe hard work is important, but balance is essential. Finding work/life balance is a vital element to our culture. To find out more about WHY Utah , click here . Other benefits may include:
 <br/>
 <br/>
 <ul>
  <li>
   Job Stability: Enjoy the security and reliability of employment within a well-established organization.
  </li>
  <li>
   Career Growth: Develop valuable skills and gain opportunities for leadership within a large organization.
  </li>
  <li>
   Meaningful Work: Contribute to an important service that benefits the community and supports organizational goals.
  </li>
  <li>
   Supportive Work Environment: Be part of a team that values cooperation, strong work ethics, and mutual support.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  The Agency
 </strong>
 The Utah Department of Public Safety (DPS) is comprised of 12 divisions and bureaus that include the Utah Highway Patrol, the Division of Emergency Management, Driver License division, Statewide Information and Analysis Center (SIAC), State Bureau of Investigation (SBI), State Fire Marshal, Highway Safety Office, Communications, State Crime Lab, Bureau of Criminal Identification, and Peace Officers Standards and Training (POST). The DPS dive team, aero bureau, CERT team and Public Protection Unit (PPU) also fall under the Department of Public Safety. DPS is made up of more than 1,500 state employees who are stationed across Utah.
 <br/>
 <br/>
 The Department of Public Safety offers a unique and rewarding employment opportunity. More information about our agency can be found on www.dps.utah.gov.
 <br/>
 <br/>
 <strong>
  EEO Statement
 </strong>
 The State of Utah is committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability, gender identity, or Veteran status. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. For accommodations, please contact (801) 957-9390.
</div>


Cyber Threat Intelligence Analyst

Tyto Athene

<div>Description:
<div>
Tyto Athene is searching for a <b>DCO Analyst</b> to support a DoD customer in Adelphi, Maryland.</div><div></div><div><b><br>
Responsibilities:</b></div><ul><li>
The DCO Team Analyst performs Security Analysis functions supporting 24/7/365 CSSP operations. Analysts monitor, detect, analyze, and respond to cyber threats targeting the DoD Information Network (DoDIN), utilizing signature detection, anomaly detection, and data visualization methods to discover, document, and report malicious and anomalous activity.</li><li>
Analyze results of signature detection, anomaly detection, and data visualization-based methods of discovering, documenting, and reporting malicious and anomalous activity as defined by DoD standards.</li><li>
Develop, implement, and maintain methods of detecting malicious and anomalous activity utilizing COTS, GOTS, and open-source tools.</li><li>
Analyze Government Furnished Data (GFD) to discover and document reconnaissance efforts, exploitation attempts, post-exploitation events, and actions on objectives.</li><li>
Track incident and event reporting to ensure fully effective mitigation and remediation actions.</li><li>
Utilize the MITRE ATT&amp;CK Framework to develop, implement, and maintain threat models containing TTPs associated with threats to the DoDIN.</li><li>
Monitor DCSB and subscriber environments for technical indicators of insider threat activity.</li><li>
Support monthly recurrent briefings providing summative reports of vulnerability data, compliance data, threat data, incident reporting data, and alerting data.</li><li>
Conduct cyber attack response and recovery in accordance with DoD and Government instructions.</li><li>
Perform continuous monitoring of network traffic on NIPRNet, SIPRNet, DREN, and cloud environments.</li><li>
Develop and maintain detection signatures, rules, and alerts for security monitoring platforms.</li><li>
Coordinate with external threat intelligence sources and DoD cyber defense organizations.</li><li>
Document findings, analysis results, and recommended actions in accordance with CSSP reporting requirements.</li><li>
Support vulnerability scanning operations using ACAS/Tenable and endpoint security solutions (ESS/HBSS).</li><li>
Participate in incident response activities and forensic analysis as required.</li></ul><div>
</div>
Qualifications:
<div><b>
Required:</b></div><ul><li>
An AA or Bachelor&rsquo;s Degree in a related technical field is required, however, can be replaced with 3 years of relevant industry experience (in addition to the minimum years of experience requirement).</li><li>
Minimum three (3) years of experience in cybersecurity analysis, threat detection, or related field.</li><li>
Experience with intrusion detection systems (IDS/IPS) and Security Information and Event Management (SIEM) platforms (e.g., Elasticsearch, Splunk).</li><li>
Knowledge of common attack vectors, malware analysis, and threat intelligence methodologies.</li><li>
Proficiency with vulnerability scanning tools (ACAS/Tenable) and endpoint security solutions (ESS/HBSS).</li><li>
Experience analyzing network traffic and security events on classified and unclassified networks.</li><li>
Familiarity with the MITRE ATT&amp;CK Framework and cyber threat intelligence practices.</li><li>
Knowledge of TCP/IP protocols, network architecture, and common network services.</li><li>
Experience with log analysis, packet capture analysis, and security event correlation.</li><li>
ITIL Foundations certification required within three (3) months of start date.</li><li>
Certifications: IAT -I CompTIA Security +CE, A+, CySA+, SSCP, CCNA - Security, GICSP, GSEC</li></ul><div><b>
Clearance:</b></div><ul><li>
TS/SCI Clearance required.</li></ul><div><b>
Location:</b></div><ul><li>
Adelphi, MD</li></ul>
About Tyto Athene:
<div><b>
Compensation:</b></div><ul><li>
Compensation is unique to each candidate and relative to the skills and experience they bring to the position. This does not guarantee a specific salary as compensation is based upon multiple factors such as education, experience, certifications, and other requirements, and may fall outside of the above-stated range.</li></ul><div><b>
Benefits:</b></div><ul><li>
Highlights of our benefits include Health/Dental/Vision, 401(k) match, Paid Time Off, STD/LTD/Life Insurance, Referral Bonuses, professional development reimbursement, and parental leave.</li></ul><div></div><div><br>
Tyto Athene is a trusted leader in IT services and solutions, delivering mission-focused digital transformation that drives measurable success. Our expertise spans four core technology domains&mdash;Network Modernization, Hybrid Cloud, Cybersecurity, and Enterprise IT&mdash;empowering our clients with cutting-edge solutions tailored to their evolving needs. With over 50 years of experience, Tyto Athene proudly support Defense, Intelligence, Space, National Security, Civilian, Health, and Public Safety clients across the United States and worldwide.</div><div>
</div><div>
At Tyto Athene, we believe that success starts with our people. We foster a collaborative, innovative, and mission-driven environment where every team member plays a critical role in shaping the future of technology. Are you ready to join #TeamTyto?</div><div>
</div><div>
Tyto Athene, LLC is an Equal Opportunity Employer; all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, [sexual orientation, gender identity,] national origin, disability, status as a protected veteran, or any characteristic protected by applicable law.</div></div>

DCO Analyst

INFRA ASSURE

<p><b>JOB TITLE: Cyber Threat Intelligence (CTI) Specialist</b></p><p>LOCATION: Qatar / Remote | TYPE: Contract / Full-time | LEVELS: 3&ndash;5 yrs / 5&ndash;10 yrs / 10&ndash;20 yrs</p><p><b>ABOUT THE ROLE</b></p><p>We are recruiting a Cyber Threat Intelligence Specialist to provide a government client in Qatar with timely, contextualized intelligence on threats relevant to their environment. You will function as the primary point for strategic, operational, and tactical threat intelligence &mdash; supporting SOC, Incident Response, and leadership with actionable intelligence products and driving threat-informed defence.</p><p><b>KEY RESPONSIBILITIES</b></p><p>- Collect and correlate threat data from internal telemetry, OSINT, commercial feeds, and community/government sources.</p><p>- Analyze threat actors, campaigns, malware, and TTPs, mapping them to MITRE ATT&amp;CK and to client assets and use cases.</p><p>- Produce intelligence reports, alerts, and advisories including IOCs, recommended countermeasures, and risk context.</p><p>- Enrich SOC detections and SIEM/EDR rules with contextual intelligence to improve detection fidelity and prioritization.</p><p>- Collaborate with Incident Response to provide adversary profiles, pivot points, and hypotheses during active investigations.</p><p>- Lead or support threat-hunting exercises using intelligence-driven hypotheses to proactively search for unknown compromises.</p><p>- Maintain an intelligence knowledge base tracking trends, historical incidents, and lessons learned.</p><p><b>REQUIRED EXPERIENCE</b></p><p>- 3&ndash;20 years of experience in threat intelligence, threat hunting, or security operations.</p><p>- Deep knowledge of MITRE ATT&amp;CK, threat actor TTPs, and intelligence lifecycle management.</p><p>- Hands-on experience with OSINT tools and techniques for adversary research.</p><p>- Experience with SIEM platforms, threat intelligence platforms (TIPs), and IOC management.</p><p>- Ability to produce both technical and strategic intelligence reports for varied audiences.</p><p>- Experience analyzing malware, phishing campaigns, and nation-state or APT group activity.</p><p>- Familiarity with threat-sharing frameworks: STIX/TAXII, MISP, or equivalent.</p><p>- Government or critical infrastructure sector experience is a strong advantage.</p><p><b>PREFERRED CERTIFICATIONS</b></p><p>Candidates holding two or more of the following certifications will be viewed very favourably:</p><p>- GCTI (GIAC Cyber Threat Intelligence) - the most directly relevant cert for this role</p><p>- CTIA (Certified Threat Intelligence Analyst, EC-Council) - strongly preferred</p><p>- GOSI (GIAC Open Source Intelligence) - valued for OSINT-heavy work</p><p>- CISSP - valued for senior-level candidates (Level 1)</p><p>- CISM - valued for senior candidates bridging intelligence and governance</p><p>- CompTIA Security+ - good baseline for Level 3 candidates entering CTI from SOC</p><p><b>WHAT WE OFFER</b></p><p>- Engagement supporting a high-profile government client in Qatar.</p><p>- Multiple experience levels considered: junior (3&ndash;5 yrs), mid (5&ndash;10 yrs), and senior (10&ndash;20 yrs).</p><p>- Competitive contract rate aligned with experience level.</p><p>- Opportunity to work on national-scale threat intelligence programmes.</p><p>Job Type: Full-time</p><p>Application Question(s):</p><ul><li>How soon can you join if selected?</li></ul><p>Work Location: Remote</p>

Cyber Threat Intelligence (CTI) Specialist

Phoenix Operations Group

<div><p>We are looking for a Cyber Hunt Analyst with Data Science experience to apply strong cyber security, Defensive Cyber Operations (DCO), and networking domain knowledge to support cyber analytics product development, threat analysis, statistical analysis, model development, and direct customer mission support. Regular cyber hunt activities consist of hunting for threats, reporting on findings, and converting tools, techniques, and processes into automated capabilities for the current cyber platform. Regular data science activities consist of operational research, statistical analysis, hypothesis testing, model building/testing, and communicating results using visualizations. Will also be responsible for collecting customer Cyber Operations requirements, generating use cases, providing Cyber SME support, and system training to end users.</p><p><b>
Essential Job Responsibilities</b></p><ul><li>
Conduct threat hunt operations on assigned JCRS-D (Big Data Platforms).</li><li>
Present threat hunt findings through live - interactive remote conference sessions.</li><li>
Perform data analytics across disparate data sets.</li><li>
Assist customer(s) with their threat hunting operations on location as required.</li><li>
Perform quality assurance checks on data that is resident on JCRS-D.</li><li>
Evaluate and analyze new data feeds to determine relevance and usability of data.</li><li>
Support JCRS-D analytic requests (data search, visualizations, dashboards..etc).</li><li>
Provide real time customer support during normal working hours (JCRS-D support chat room).</li><li>
Maintain situational awareness of emerging cyber threats for possible action and notification to an impacted customer(s).</li><li>
Support JCRS-D demonstration requests to showcase various capabilities of the platform.</li><li>
Support JCRS-D training events either in person or virtually.</li><li>
Provide advice on data enrichment and functions to enhance customer experience.</li><li>
Other duties as assigned.</li></ul><p><b>
Minimum Qualifications</b></p><ul><li>
Security Clearance - A current TS/SCI level U.S. Government clearance with Polygraph is required. U.S. Citizenship required.</li><li>
5+ years experience in cyber security operations related fields with Bachelors in Information Technology, Cyber Security or related field; 3 years relevant experience with Masters in realted field; or High School Diploma or equivalent and 9 years relevant experience.</li><li>
Experience with the DoD customers, ideally supporting US Cyber Command, USMC, DISA or DCDC</li><li>
Proficient in various query languages (SQL, KQL (Kusto))</li><li>
Proficient in Python and bonus for strong experience using Jupyter notebooks</li><li>
Experience with dashboarding/visualizations (Power-BI, Superset)</li><li>
Familiarity with cloud providers and environments (Azure, AWS, Google Cloud Platform)</li><li>
Desire to grow professional and personally</li><li>
Ability to complete technical tasks without supervision</li><li>
Ability to foster and support a collaborative working environment</li><li>
Excellent public speaking, presentation, and customer service skills.</li><li>
Positive and energetic attitude</li><li>
Critical thinking and natural curiosity for all things cybersecurity</li><li>
Cyber Hunt methodologies and techniques</li><li>
SIEMs - (e.g., Splunk, Q-Radar, ELK)</li><li>
SOARs (e.g., Sentinel, CORTEX, X-SOAR)</li><li>
Developing and deploying threat detection signatures</li><li>
Detecting host and network-based intrusions</li><li>
Collecting data from a variety of cyber defense resources. (e.g., CVE, OSINT)</li><li>
Recognizing and categorizing types of vulnerabilities and associated attacks</li><li>
Reading and interpreting signatures (e.g., SNORT, SIGMA, Yara, YAML)</li><li>
Cyber defense and vulnerability assessment tools and their capabilities</li><li>
Network traffic analysis methods (e.g.,TCP-DUMP, Wireshark, Bro/Zeek)</li><li>
Familiar with cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks), and incident response and handling methodologies. (e.g., MITRE ATT&amp;CK, LM Killchain)</li><li>
Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications</li><li>
Must have or ability to obtain within 90 days of hire - Data+, Security+, CySA+, GCIH, GNFA, GCFA or other industry recognized Cybersecurity Certification.</li><li>
Ability to work a hybrid schedule on customer site in Fort Meade, MD on average 3 days a week. Flexibility is essential to adapt to schedule changes as needed.</li></ul><p><b>
Preferred Requirements</b></p><ul><li>
DoD SOC experience is a plus</li></ul><p><b>
Benefits Offered:</b></p><p>
Medical, Dental, Vision Insurance - 100% Company Paid Premiums</p><p>
STD, LTD, and Life Insurance - 100% Company paid</p><p>
401K &ndash; Automatic 10% company contribution; no matching required</p><p>
PTO - 4 weeks/year</p><p>
Holidays - 11 paid/year</p><p>
Birthdays off with pay</p><p>
Referral Bonuses &ndash; Upfront AND Annually Recurring</p><p>
Open Source Bonuses &ndash; Contribute to our Github projects</p><p>
Professional Development &ndash; Paid training, Certifications, and Enrichment</p><p><b>
ABOUT PHOENIX OPERATIONS GROUP:</b></p><p>
Phoenix Operations Group is a high-end engineering services company dedicated to protecting and advancing our national cyber resources. As a small company, we rely on innovation to continually advance our employees' skills and provide game-changing solutions to our customers.</p><p>
Our technical competencies include Big Data analytics (batch and streaming), Cloud Computing infrastructure, multi-INT visualization, and enterprise architectures. We support operational missions (All-Source, Financial, CND) and serve as Product Owners for our open-source research initiatives.</p><p>
Please visit us at http://www.phoenix-opsgroup.com for more information.</p><p>
Phoenix Operations Group is an Equal Opportunity Employer. Phoenix Operations Group does not discriminate based on race, religion, color, sex, gender, gender identity, sexual orientation, age, non-disqualifying physical or mental disability, national origin, veteran status, or any other basis covered by appropriate law. All employment is decided based on qualifications, merit, and business needs.</p></div>

Cyber Hunt Analyst (Hybrid) - TS/SCI Required

Principal Financial Group

<div>What You'll Do:
<p>
We&rsquo;re looking for an experienced Cyber Security Analyst to join our Threat Intelligence Security team. In this role, you&rsquo;ll have the chance to help mature our threat intelligence service to support operational and tactical decision-making across the organization. Members of this team are highly motivated, dedicated, and passionate about cyber defense.</p><p></p><p><br>
You'll have the opportunity to:</p><ul><li>
Perform day-to-day threat intelligence operations, including source collection/management of threat intel, analysis and production of intelligence, dissemination of intelligence, and threat hunting</li><li>
Contribute to the strategy and design of the threat intelligence service</li><li>
Provide intelligence support during incident response activities, and directly assist with significant incidents</li><li>
Produce threat analysis reports, briefings, and actionable insights for the security operation center</li><li>
Develop and maintain methodology to track adversaries targeting our organization and industry</li><li>
Prepare and deliver internal threat intelligence reports, briefings about threat actors, TTPs, and external threats to internal teams and leadership on changes to the cyber threat landscape</li><li>
Collect information on threats to the organization through communication with other partner institutions, mailing lists, open-source news, and industry partnerships</li><li>
Leverage an intrusion framework, such as Kill Chain or Diamond, to develop a rich portfolio of threat actors&rsquo; tactics and activity that will support the ongoing improvement of cyber defenses</li></ul><p>
Operating at the intersection of financial services and technology, Principal builds financial tools that help our customers live better lives. We take pride in being a purpose-led firm, motivated by our mission to make financial security accessible to all. Our mission, integrity, and customer focus have made us a trusted leader for more than 140 years.</p>
Who You Are:
<ul><li>Bachelor's degree in a related field or equivalent experience</li><li>
4+ years of cybersecurity technology experience with a preference in threat intelligence</li><li>
Experience writing scripts (e.g., Python or similar languages) and developing queries for security platforms such as SIEM and EDR</li><li>
Experience with threat intelligence platforms and tooling, reporting, intelligence enrichment and integration processes</li><li>
Knowledge of the Cyber Kill Chain, Diamond Model of Intrusion Analysis, or other intelligence frameworks</li><li>
Experience with analyzing and interpreting data from various sources, documenting the results and providing meaningful analysis reports and briefings</li><li>
Ability to communicate/interact with various audiences, including senior leaders</li><li>
Proven knowledge of common adversary tactics, techniques, and procedures (TTPs)</li><li>
Self-motivated, analytical, and resourceful</li></ul><div><b>
Skills That Will Help You Stand Out
</b></div><ul><li>Professional threat Intelligence experience</li><li>
Experience driving innovation, continuous improvement mindset, and maturing threat intelligence offerings</li><li>
Ability to create reports, actionable intelligence, and threat insights</li></ul>
Salary Range Information: Salary ranges below reflect targeted base salaries. Non-sales positions have the opportunity to participate in a bonus program. Sales positions are eligible for sales incentives, and in some instances a bonus plan, whereby total compensation may far exceed base salary depending on individual performance. Actual compensation for all roles will be based upon geographic location, work experience, education, licensure requirements and/or skill level and will be finalized at the time of offer. Salary Range: $110000 - $132000 / year Salary Details:
<div><b>
Work Environments</b></div><div>
This position is located in our corporate office in Des Moines, IA, and offers in-office, hybrid (blending at least three office days in a typical workweek) in Des Moines, IA.</div><h2 class="jobSectionHeader"><b>
Work Authorization/Sponsorship
</b></h2><div>At this time, we're not considering candidates that need any type of immigration sponsorship (additional work authorization or permanent work authorization) now or in the future to work in the United States. This includes, but IS NOT LIMITED TO: F1-OPT, F1-CPT, H-1B, TN, L-1, J-1, etc. For additional information around work authorization needs please use the following links.</div><h2 class="jobSectionHeader"><b>
Nonimmigrant Workers</b><b> and </b><b>Green Card for Employment-Based Immigrants</b></h2><div><b>
Investment Code of Ethics
</b></div><div>For Principal Global Investors positions, you&rsquo;ll need to follow an Investment Code of Ethics related to personal and business conduct as well as personal trading activities for you and members of your household. These same requirements may also apply to other positions across the organization.</div><h2 class="jobSectionHeader"><b>
Experience Principal
</b></h2><div>While our expertise spans the globe, we're bound by one common purpose: to foster a world where financial security is accessible to all. And our success depends on the unique experiences, backgrounds, and talents of our employees &ndash; individually and all of us together. Explore our core values, benefits and why we&rsquo;re an exceptional place to grow your career.</div><h2 class="jobSectionHeader"><b>
Principal is an Equal Opportunity Employer
</b></h2><div>All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.</div>
Time Off Program: Flexible Time Off (FTO) is provided to salaried (exempt) employees and provides the opportunity to take time away from the office with pay for vacation, personal or short-term illness. Employees don&rsquo;t accrue a bank of time off under FTO and there is no set number of days provided. Pension Eligible: Yes Posting Window: We will accept applications for 3 full days following the Original Posting Date, after which the posting may remain open or be removed based upon applications received. If we choose to post the job again, we will accept additional applications for at least 1 full day following the Most Recently Posted Date. Please submit applications in a timely manner as there is no guarantee the posting will be available beyond the applicable deadline. Date First Posted (TTF): 4/10/2026 Latest Post Date: Careers - US: 4/10/2026
<p>LinkedIn Hashtag</p>
: #LI-EW1</div>

Cyber Security Analyst III

Weeghman & Briggs

<div><p><b>Intrusion Analyst 3</b></p><p><b>
Location:</b> Annapolis Junction, MD | Onsite <b>Clearance Required:</b> TS/SCI with Polygraph <b>Employment Type:</b> Full-Time <b>Salary Range:</b> $175,000&ndash;$185,000</p><p><b>
Join a Growing Team at WeeghmanBriggs</b></p><p>
WeeghmanBriggs is seeking a missiondriven <b>Intrusion Analyst 3</b> to support critical national security initiatives in Annapolis Junction, MD.</p><p>
Founded in 2016 by Anthony Jordan, WeeghmanBriggs specializes in delivering highimpact analytical and technical services to Government Agencies and private organizations. As we continue to expand across current programs and upcoming contract awards, we are looking for talented professionals who want to contribute, grow, and build something meaningful alongside us.</p><p>
At WeeghmanBriggs, you're more than a number-you're part of the team. Your voice is heard, your expertise matters, and your work directly supports mission success. Our growth creates opportunities for advancement, leadership visibility, and longterm career development while maintaining the closeknit, supportive culture that sets us apart.</p><p>
If you're ready to grow your career while supporting important national missions, we'd love to connect with you.</p><p><b>
About the Mission</b></p><p>
Your effort and expertise are crucial to the success of this impactful mission. You will support a diverse team of Data Scientists, Cryptologic Computer Scientists, Cryptanalytic Computer Scientists, Cryptologic Cyber Planners, Intrusion Analysts, Protocol Analysts, Signals Analysts, and Reverse Engineers-professionals dedicated to improving, protecting, and defending our Nation's Security.</p><p><b>
What You'll Do</b></p><ul><li>
Analyze target digital network data to identify, document, and report malicious or unauthorized activity using SIGINT and computer network defense resources.</li><li>
Examine metadata from tasked communications systems to identify, locate, and track targets.</li><li>
Categorize network traffic as benign, suspicious, or malicious, and document associated TTPs.</li><li>
Develop and implement mitigation strategies to protect mission systems.</li><li>
Apply a networkfocused and/or hostbased approach to intrusion analysis.</li><li>
Collaborate with crossfunctional teams to deliver highquality, missionrelevant results.</li><li>
Ensure compliance with contract and security standards.</li><li>
Contribute ideas to improve processes, efficiency, and analytical performance.</li></ul><p><b>
What You Bring</b></p><ul><li>
Active TS/SCI with FullScope Polygraph</li><li>
Master's degree with <b>6 years</b> of relevant experience</li><li>
Bachelor's degree with <b>8 years</b> of relevant experience</li><li>
Associate degree with <b>10 years</b> of relevant experience</li><li>
Bachelor's degree must be in <b>Computer Science, Computer Engineering, Information Systems, or a related discipline</b></li><li>
Relevant experience must include <b>malware analysis</b></li><li>
Programming experience in <b>C, C#, C++, Java, Perl, or Python</b> is preferred</li><li>
Strong written and verbal communication skills</li><li>
Ability to work independently and within a collaborative team environment</li><li>
Experience supporting government or DoD programs</li></ul><p><b>
Required Certifications</b></p><ul><li>
CISSP</li><li>
CEH</li><li>
Security+</li><li>
Network+</li><li>
GIAC GREM and/or CREA</li></ul><p><b>
Preferred Qualifications</b></p><ul><li>
Experience supporting specific DoD or Intelligence Community programs</li><li>
Background in cyber operations, intrusion analysis, or advanced threat detection</li><li>
Familiarity with Agile, cloud, or modernization initiatives</li><li>
Experience in process improvement or analytical services</li></ul><p><b>
CompensationBenefits</b></p><p>
The projected salary range for this position is <b>$175,000&ndash;$185,000</b>, dependent upon experience, qualifications, and contract requirements.</p><p>
WeeghmanBriggs offers a competitive benefits package designed to support you both professionally and personally.</p><p>
Learn more about our comprehensive benefits: Summary of Benefits (weeghmanandbriggs.com in Bing)</p><p><b>
Equal Employment Opportunity</b></p><p>
WeeghmanBriggs is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, veteran status, or any other protected characteristic.</p></div>

Intrusion Analyst Level 3

Search 3837+ Cyber threat analyst jobs near you this April. New roles added regularly across leading industries. Apply today.