cyber threat analyst

The Amatriot Group

<div><div>Cyber Threat Analyst<br>
5 Year DoJ Contract | Chantilly, VA<br>
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in<br>
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in<br>
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion<br>
investigation, host-based forensic analysis, network traffic analysis, and attribution support<br>
within a highly sensitive operational environment. The ideal candidate will possess experience<br>
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard<br>
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and<br>
support investigative operations.<br>
Responsibilities<br>
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations.<br>
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments.<br>
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and<br>
unauthorized access.<br>
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of<br>
compromise.<br>
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative<br>
lead generation.<br>
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence.<br>
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes.<br>
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies.<br>
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and<br>
procedures (TTPs).<br>
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations.<br>
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders.<br>
Required Skills &amp; Experience<br>
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph.<br>
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered<br>
in lieu of years of experience<br>
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk<br>
o EnCase<br>
o Magnet AXIOM<br>
o X-Ways Forensics<br>
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis.<br>
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

<div>
 5 Year DoJ Contract | Chantilly, VA
 <br/>
 <br/>
 Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in
 <br/>
 <br/>
 analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in
 <br/>
 <br/>
 support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion
 <br/>
 <br/>
 investigation, host-based forensic analysis, network traffic analysis, and attribution support
 <br/>
 <br/>
 within a highly sensitive operational environment. The ideal candidate will possess experience
 <br/>
 <br/>
 analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard
 <br/>
 <br/>
 forensic and cyber analysis tools to identify malicious activity, recover artifacts, and
 <br/>
 <br/>
 support investigative operations.
 <br/>
 <br/>
 <strong>
  Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Process, evaluate, and analyze digital network communications and cyber threat data to
   <br/>
   <br/>
  </li>
 </ul>
 identify malicious activity and support investigative operations.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and
   <br/>
   <br/>
  </li>
 </ul>
 network environments.
 <br/>
 <br/>
 <ul>
  <li>
   Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets
   <br/>
   <br/>
  </li>
 </ul>
 to identify indicators of compromise, attacker activity, persistence mechanisms, and
 <br/>
 <br/>
 unauthorized access.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,
   <br/>
   <br/>
  </li>
 </ul>
 software usage, command execution, credential activity, and network-based indicators of
 <br/>
 <br/>
 compromise.
 <br/>
 <br/>
 <ul>
  <li>
   Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,
   <br/>
   <br/>
  </li>
 </ul>
 and user activity across multiple data sources to support attribution and investigative
 <br/>
 <br/>
 lead generation.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline
   <br/>
   <br/>
  </li>
 </ul>
 execution, and other system-level forensic evidence.
 <br/>
 <br/>
 <ul>
  <li>
   Draft detailed technical reports and analytical findings based on cyber investigations
   <br/>
   <br/>
  </li>
 </ul>
 while participating in internal review and quality assurance processes.
 <br/>
 <br/>
 <ul>
  <li>
   Support development and refinement of cyber analysis processes, CONOPS, SOPs,
   <br/>
   <br/>
  </li>
 </ul>
 and investigative methodologies.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct open-source and intelligence community research to maintain awareness of
   <br/>
   <br/>
  </li>
 </ul>
 emerging cyber threats, malware trends, and adversary tactics, techniques, and
 <br/>
 <br/>
 procedures (TTPs).
 <br/>
 <br/>
 <ul>
  <li>
   Collaborate with internal teams and mission partners across the intelligence community
   <br/>
   <br/>
  </li>
 </ul>
 to support tactical and strategic cyber operations.
 <br/>
 <br/>
 <ul>
  <li>
   Provide operational updates and analytical findings to leadership and investigative
   <br/>
   <br/>
  </li>
 </ul>
 stakeholders.
 <br/>
 <br/>
 <strong>
  Required Skills &amp; Experience
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Active Top Secret Clearance required, with willingness and ability to obtain a Counter
   <br/>
   <br/>
  </li>
 </ul>
 Intelligence (CI) Polygraph.
 <br/>
 <br/>
 <ul>
  <li>
   BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced
   <br/>
   <br/>
  </li>
 </ul>
 certifications, specialized training, or equivalent hands-on experience may be considered
 <br/>
 <br/>
 in lieu of years of experience
 <br/>
 <br/>
 <ul>
  <li>
   Experience performing host-based forensic analysis utilizing Splunk.
  </li>
  <li>
   Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.
  </li>
  <li>
   Hands-on experience with industry-standard forensic tools such as:
  </li>
  <li>
   Splunk
  </li>
  <li>
   EnCase
  </li>
  <li>
   Magnet AXIOM
  </li>
  <li>
   X-Ways Forensics
  </li>
  <li>
   Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,
   <br/>
   <br/>
  </li>
 </ul>
 and forensic artifact analysis.
 <br/>
 <br/>
 <ul>
  <li>
   Experience correlating threat indicators and investigative data to support attribution and
   <br/>
   <br/>
  </li>
 </ul>
 operational analysis.
</div>


Booz Allen Hamilton

<div>Cyber Threat Intelligence Analyst<p><b>
The Opportunity</b><b>:</b></p><p>
We are seeking an experienced Cyber Threat Intelligence Analyst to join our Security Operations Center (SOC) team. This role supports analysis and research on latest advanced cyber threats to provide actionable threat intelligence that includes adversary indicators of compromise (IOCs), Techniques, Tactics, and Procedures (TTPs), behaviors, and trends to help defend the client agency. You will conduct analysis to profile threat actor TTPs used to infiltrate networks, systems, and assets to produce threat actor cards, profiles, or threat briefs. You&rsquo;ll report on current and emerging threats that will exploit vulnerabilities and details of the vulnerabilities to stakeholders.</p><p></p><p>
You will collect, analyze, and correlate cyber threat intelligence from open-source, commercial, and government sources. You&rsquo;ll actively monitor open-source intelligence, industry reports, and internal security logs to gather threat information, then synthesize and disseminate critical insights to relevant stakeholders. You&rsquo;ll conduct tactical, operational, and strategic threat analysis in support of ongoing monitoring and investigations, identify patterns, and attribute attacks to specific actors. You will track threat actors, phishing campaigns, malware, and TTPs relevant to the agency&rsquo;s mission and technology footprint. You&rsquo;ll produce actionable reports, briefings, and indicators of compromise (IOCs) for internal stakeholders and support development of new detection rules and analytics based on evolving threats.<br>
<br>
Cyber threats are evolving. Booz Allen is committed to creating an environment where you not only keep pace with the industry, but propel it forward. With access to academic programs, certifications, and opportunities to use expert tradecraft, we&rsquo;ll continuously invest in you so you can create the career you want as you grow.</p><p></p><p>
Join us. The world can&rsquo;t wait.<br>
<br>
<b>You Have:</b></p><ul><li><p>
Experience as a cyber threat analyst collaborating with multiple internal and external stakeholders to gather data and intelligence, analyze, vet, and enrich the intelligence, create joint reports, and share with stakeholders</p></li><li><p>
Experience using intelligence platforms such as MISP Threat Intelligence Platform</p></li><li><p>
Knowledge of CNE and CNA tools and tradecraft along with signatures and Tactics, Techniques, and Procedures (TTPs) associated with preparation for and execution or implementation of such attacks</p></li><li><p>
Knowledge of cyber threats, open-source research, nation state actors, vulnerabilities, and cyber attacks</p></li><li><p>
Ability to prioritize and juggle multiple events or initiatives simultaneously</p></li><li><p>
Top Secret clearance</p></li><li><p>
Bachelor&rsquo;s degree and 15+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role, or 19+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role in lieu of a degree</p></li></ul><p></p><p><b>
Nice If You Have:</b></p><ul><li><p>
Experience working in a SOC or cyber operations environment</p></li><li><p>
Experience working with Splunk, including writing or understanding queries and evaluating telemetry logs</p></li><li><p>
Knowledge of current and emerging cyber adversaries and their Techniques, Tactics, and Procedures (TTPs)</p></li><li><p>
Knowledge of threat modeling and adversary tactics and techniques frameworks such as MITRE ATT&amp;CK matrices, Cyber Kill Chain, STRIDE, or PASTA</p></li><li><p>
Knowledge of Confluence and Jira</p></li><li><p>
Knowledge of ServiceNow or similar ticketing systems</p></li><li><p>
Ability to write and deliver succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences</p></li><li><p>
CISSP, GCTI, GCIA, GCIH, CEH, CTIA, or equivalent Certification</p></li></ul><p></p><p><b>
Clearance:</b><br>
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Top Secret clearance is required.</p><p></p><p><b>
Compensation</b></p><p>
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.</p><p></p>
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.<p></p><p><b>
Identity Statement</b></p><p>
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.</p><p></p><p><b>
Candidate AI Usage Policy</b></p><p>
AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on <b>your </b>own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited <b>unless permission is explicitly provided</b>.
</p><p></p><p><b>Work Model</b><br>
Our people-first culture prioritizes the benefits of collaboration, whether it occurs in person or virtually. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.</p><ul><li><p><b>
Remote</b>: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.</p></li><li><p><b>
Hybrid</b>: If this position is listed as hybrid, you will be expected to work from a Booz Allen facility frequently, in alignment with leadership expectations and the needs of the role. You may also be required to work from or visit a customer facility.</p></li><li><p><b>
Onsite</b>: If this position is listed as onsite, work will primarily be performed at a Booz Allen office or customer facility, where employees will collaborate directly with colleagues and customers as required by the role.</p></li></ul><p></p><p><b>
Commitment to Non-Discrimination</b></p><p>
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</p></div><p></p>

Cyber Threat Intelligence Analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

Eli Lilly

<div><p>At Lilly, we unite caring with discovery to make life better for people around the world. We are a global healthcare leader headquartered in Indianapolis, Indiana. Our employees around the world work to discover and bring life-changing medicines to those who need them, improve the understanding and management of disease, and give back to our communities through philanthropy and volunteerism. We give our best effort to our work, and we put people first. We&rsquo;re looking for people who are determined to make life better for people around the world.</p><p></p><p>
The Cyber Threat Intelligence (CTI) Lead Analyst leads one of the eight functional teams within Global Cyber Defense Operations (GCDO). The role directs the strategy, operations, and continued maturation of Lilly's Cyber Threat Intelligence function &mdash; covering threat actor tracking and attribution, brand and executive protection, intelligence sharing collaborators, and the integration of intelligence into detection, response, and proactive defense across GCDO.</p><p></p><p>
This is a player/coach role. The CTI Lead Analyst is expected to maintain personal technical depth in threat analysis and set the example of the standard on the hardest analytical work, while simultaneously shaping the strategy of the function, developing the analyst team, and representing GCDO across multi-functional and external forums. Candidates should expect to spend their time across both the technical and strategic dimensions of the role rather than choosing one.</p><p></p><p><b>
What You Will Do:</b></p><ul><li><p><b>
Function Strategy and Maturation: </b>Lead the continued development and maturation of the Cyber Threat Intelligence function, advancing it from intelligence consumer to intelligence producer and contributor across the pharmaceutical industry and the broader cyber community.</p></li><li><p><b>
Hands-on Technical Leadership (Player/Coach): </b>Maintain personal technical proficiency in threat analysis, attribution, and intelligence tradecraft. Be the example on complex analytical work, set the technical bar for the team, and remain credible at the keyboard while developing analyst capability.</p></li><li><p><b>
Threat Actor Tracking and Attribution: </b>Direct the threat actor tracking and attribution program as a multi-functional Cybersecurity capability &mdash; championing adoption across response, detection, architecture, platforms, threat mitigation, identity, and other defensive functions, while remaining accountable for the program's outputs, methodology, and long-term maturation. Maintain alignment between internally tracked activity clusters and industry-recognized threat actor designations to support shared understanding across the security community. Ensure the program produces actionable intelligence that informs detection, response, and strategic decisions across the enterprise.</p></li><li><p><b>
Brand and Executive Protection: </b>Lead the cyber threat intelligence components of brand and executive protection, in close coordination with Corporate Security, Legal, the Brand Office, and other partners. Drive multi-functional governance to reduce duplication and improve coverage across protective monitoring services.</p></li><li><p><b>
Partner Collaboration: </b>Develop and maintain strong working relationships with key partners across Cybersecurity, Corporate Security, HR, Legal, the Brand Office, Ethics &amp; Compliance, and Tech@Lilly. Represent GCDO and the CTI function in multi-functional forums where intelligence drives prioritization.</p></li><li><p><b>
Intelligence Sharing and Industry Engagement: </b>Strengthen Lilly's role as an active contributor in pharmaceutical-sector and cross-industry intelligence sharing communities. Direct analyst engagement in intelligence sharing collaborators and ensure Lilly contributes high-value research at a cadence consistent with peer organizations.</p></li><li><p><b>
Team Leadership and Development: Lead a team</b> of cyber threat intelligence analysts. Provide direction, mentorship, and structured development. Build a high-performing team with clear succession depth across analyst tradecraft, brand protection, and strategic intelligence.</p></li><li><p><b>
Tooling and Capability Enhancement: </b>Direct the evaluation, introduction, and integration of capabilities supporting the CTI mission. Ensure intelligence is operationalized into automated enrichment, detection, and response workflows across the GCDO toolchain.</p></li><li><p><b>
Incident Response Support: </b>Provide intelligence-driven support to incident response investigations, particularly for sophisticated and targeted activity. Ensure CTI insights inform the full response lifecycle from triage through after-action review.</p></li><li><p><b>
Training, Awareness, and Communication: </b>Develop and deliver training and awareness programs that improve the organization's understanding of the external threat landscape. Communicate intelligence findings in formats appropriate for technical analysts, operational leaders, and senior leaders.</p></li></ul><p></p><p><b>
Your Minimum Basic Qualifications</b></p><ul><li><p>
HS Diploma/GED required</p></li><li><p>
7+ years of shown experience in Cybersecurity, including hands on cyber threat intelligence work</p></li><li><p><b>
Demonstrated experience materially contributing to threat actor tracking, attribution, and analytical methods that directly inform defensive decisions.</b></p></li><li><p><b>
Evidence of skills in areas e.g., malware analysis and/or reverse engineering, and campaign tracking to understand adversary objectives, techniques, and patterns.
</b></p></li><li><p><b><i>Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.</i></b></p></li></ul><p><b>
Additional Skills / Preferences</b></p><ul><li><p>
Proven ability to operate as a player/coach &mdash; maintaining technical depth while leading a team and shaping strategy</p></li><li><p>
Strong analytical and problem-solving skills, with a track record of producing intelligence that drives decisions</p></li><li><p>
Experience leading or significantly contributing to a threat actor tracking, attribution, or intelligence analysis program</p></li><li><p>
Experience working across brand protection, executive protection, or related multi-functional domains is preferred</p></li><li><p>
Clear and confident communicator, with the ability to translate technical intelligence for technical, operational, and executive audiences</p></li><li><p>
Ability to work independently and lead through influence across organizational boundaries</p></li><li><p>
High level of integrity and ethical standards; awareness of laws, regulations, policies, and ethics as they relate to cybersecurity, privacy, and intelligence work</p></li><li><p>
Relevant certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA)</p></li></ul><p><b>
Additional Information</b></p><p>
Due to the global nature of this position, some international travel may be required.</p><p>
This position may be filled with a remote worker. Remote workers may be asked to travel based on business needs, which would require discussion and approval from the employee's supervisor.</p><p>
Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.</p><p></p><p>
Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status.</p><p><br>
Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia Network, Black Employees at Lilly, Chinese Culture Network, Japanese International Leadership Network (JILN), Lilly India Network, Organization of Latinx at Lilly (OLA), PRIDE (LGBTQ+ Allies), Veterans Leadership Network (VLN), Women&rsquo;s Initiative for Leading at Lilly (WILL), enAble (for people with disabilities). Learn more about all of our groups.</p><p></p><p>
Actual compensation will depend on a candidate&rsquo;s education, experience, skills, and geographic location. The anticipated wage for this position is</p>
$162,000 - $268,400<p></p><p>
Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly&rsquo;s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.</p><p></p><p>
#WeAreLilly</p></div>

Cyber Threat Intelligence - Lead Analyst

Peraton

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
We are seeking a highly skilled and innovative Threat Intelligence Analyst to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div><br>
Responsibilities</div><ul><li>
Collect, fuse, and analyze threat intelligence from ACERT, DISA, ARCYBER, US‑CERT, commercial feeds, and enterprise telemetry to build an accurate threat picture for the ARNG environment.</li><li>
Map adversary TTPs to local technologies, CDAP/CHAP findings, and control gaps; prioritize detections, hunts, and mitigation actions.</li><li>
Produce and distribute threat briefs, IOCs, analytic notes, dashboards, and executive summaries to SOC, hunters, detection engineers, CIRT, DCO, and leadership.</li><li>
Develop enrichment logic, correlation rules, and intelligence‑driven detection/use cases to operationalize intelligence into SIEM/EDR/SOAR workflows.</li><li>
Validate indicators and detection logic with SOC analysts, incident responders, and engineering teams; support hunt missions and incident investigations with contextual intelligence.</li><li>
Track adversary campaigns, malware trends, vulnerability exploit patterns, and translate into mission‑focused recommendations for defensive measures.</li><li>
Maintain threat repositories, automation playbooks, and analytic artifacts to enable repeatable, machine‑readable intel workflows and situational awareness.</li><li>
Liaise with external intel partners and keep abreast of emerging tools, techniques, and reporting to inform enterprise readiness and response posture.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Strategic Intelligence, Cybersecurity Risk Management, Computer Science, Data Science, Information Systems, Information Technology, or a related field; OR</li><li>
Relevant DoD/IC advanced training (examples: DIA Advanced Cyber Threat Analysis; National Cryptologic School advanced cyber intelligence courses; SANS FOR578); OR</li><li>
Relevant professional certification or equivalent experience (examples: CISSP; CompTIA CASP+; GIAC GCIA; GIAC GREM; CREST CCTIM).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat intelligence, analysis, or related analytic experience with at least 3 years performing senior TI roles supporting SOC/CIRT or DoD missions.</li><li>
Expertise mapping TTPs to MITRE ATT&amp;CK, developing IOCs, and producing decision‑grade analytic products and executive briefings.</li><li>
Proficiency with TI platforms, TIPs, SIEM/EDR integration, enrichment pipelines, and threat data automation.</li><li>
Strong analytic writing, briefing, and stakeholder engagement skills to translate intelligence into operational tasks and strategic recommendations.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior experience supporting ARCYBER, NETCOM, RCC‑ARNG, or joint/IC threat intelligence operations.</li><li>
Familiarity with malware analysis, reverse‑engineering outputs, and integrating CTI into detection engineering and hunt workflows.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader"><b>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statements:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

THREAT INTELLIGENCE ANALYST

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
We are seeking a highly skilled and innovative Threat Hunter to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div><br>
Responsibilities</div><ul><li>
Lead proactive threat‑hunting operations: develop hypotheses, analytic campaigns, and hunting workflows to detect sophisticated adversary behaviors across networks, endpoints, cloud, and OT/DCI systems.</li><li>
Build behavioral detection logic, long‑term analytic patterns, and anomaly models mapped to MITRE ATT&amp;CK TTPs.</li><li>
Leverage threat intelligence, incident trends, CDAP findings, and vulnerability data to prioritize high‑risk hunt objectives and scope.</li><li>
Conduct deep forensic and telemetry analysis to uncover lateral movement, persistence mechanisms, credential misuse, and stealthy C2 activity.</li><li>
Develop hunt playbooks, repeatable methodologies, and validation procedures to elevate enterprise hunting maturity.</li><li>
Integrate hunting outputs into SOC, CIRT, RCC‑ARNG, NETCOM, and ARCYBER operations by delivering actionable detections, validated indicators, and threat behavior insights.</li><li>
Collaborate with detection engineering to convert hunt findings into high‑fidelity detections, tune SIEM/EDR rules, and expand telemetry coverage.</li><li>
Produce detailed technical reports, intelligence briefs, and executive summaries to inform remediation, detection priorities, and strategic risk decisions.</li><li>
Drive continuous improvement: identify telemetry gaps, enhance data‑enrichment pipelines, automate analytic processes, and evaluate emergent hunting tools and techniques.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, Software Engineering, or a related field; OR</li><li>
Relevant DoD/military training (examples: 4‑11‑C32‑255S (CP); 4C‑255N (CP); 4C‑255A (CP); M0923W1; A‑531‑4417; Cyber Defense Analyst (Advanced) Playlist); OR</li><li>
Relevant professional certification or equivalent experience (examples: CBROPS; CFR; CySA+; GCFA; GCIA; GICSP).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat analysis, hunting, or advanced detection experience with at least 3 years leading hunt operations or detection programs in enterprise or DoD contexts.</li><li>
Deep expertise in telemetry analytics, log forensics, memory/disk analysis, and threat‑hunting toolchains (SIEM, EDR, network forensics).</li><li>
Proven ability to author hunt hypotheses, design validation tests, and operationalize findings into detection engineering and incident response workflows.</li><li>
Strong familiarity with MITRE ATT&amp;CK, threat‑intelligence integration, adversary emulation, and validation methodologies.</li><li>
Excellent technical writing and briefing skills for producing reproducible hunt artifacts, IOC packages, and executive‑level intelligence products.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior DoD/ARNG threat‑hunting or CDAP experience and experience coordinating with ARCYBER/NETCOM/RCC‑ARNG.</li><li>
Experience with automation of hunting workflows, advanced analytics (ML/behavioral models), and large‑scale telemetry platforms.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader"><b>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statements:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

THREAT HUNTER

Search 2478+ Cyber threat analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

2478 cyber threat analyst jobs Near Me

Cyber Threat Analyst

Cyber Threat Analyst

Cyber Threat Intelligence Analyst

SBA - Cyber Threat Intelligence Analyst

Cyber Threat Intelligence - Lead Analyst

THREAT INTELLIGENCE ANALYST

THREAT HUNTER