forensic analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader">Digital Forensics Engineer Job Description</h1>
Position Title: Digital Forensics Engineer 
Program: SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader">
Position Summary</h2>
The Digital Forensics Engineer supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by providing advanced digital forensics, incident response, cyber investigation, evidence preservation, malware analysis, and e-discovery support services. 
The Digital Forensics Engineer conducts complex forensic examinations involving workstations, servers, cloud platforms, mobile devices, email systems, network traffic, and enterprise applications in support of cybersecurity investigations, incident response activities, insider threat investigations, legal support actions, and enterprise cyber defense operations. The role supports 24x7x365 Security Operations Center (SOC) functions and coordinates closely with federal stakeholders, incident responders, threat hunters, legal teams, privacy personnel, and law enforcement partners.<h2 class="jobSectionHeader">
Essential Duties and Responsibilities</h2><ul><li>
Perform advanced digital forensic analysis and investigations in support of SBA ECS cybersecurity operations requirements.</li><li>
Support Task Areas 3.5.3 and 3.5.3.6 by conducting forensic examinations related to cybersecurity incidents, insider threats, malware infections, unauthorized access, and data exfiltration.</li><li>
Collect, preserve, analyze, and document digital evidence in accordance with federal forensic standards and chain-of-custody procedures.</li><li>
Perform host-based, network-based, cloud-based, and mobile device forensic investigations across enterprise environments.</li><li>
Conduct forensic acquisition and analysis of Windows, Linux, macOS, cloud, virtualized, and hybrid systems.</li><li>
Analyze endpoint telemetry, security logs, network packet captures (PCAP), SIEM data, and forensic artifacts to identify indicators of compromise (IOCs) and adversary activity.</li><li>
Support incident response activities by reconstructing attack timelines, determining root cause, identifying attack vectors, and assessing operational impact.</li><li>
Perform malware analysis and reverse engineering support activities to identify malicious behaviors, persistence mechanisms, and command-and-control communications.</li><li>
Support e-discovery operations including collection, indexing, preservation, processing, and review of electronically stored information (ESI).</li><li>
Conduct forensic examinations supporting legal, Inspector General (IG), Human Resources (HR), insider threat, privacy, and law enforcement investigations.</li><li>
Utilize forensic and cyber defense tools including EnCase, FTK, Velociraptor, Wireshark, Volatility, Splunk, Microsoft Defender, Sentinel, and endpoint detection and response (EDR) platforms.</li><li>
Perform memory analysis, disk analysis, registry analysis, browser artifact analysis, and log correlation activities.</li><li>
Develop forensic reports, technical findings, evidentiary documentation, executive briefings, and remediation recommendations.</li><li>
Maintain detailed forensic documentation, evidence handling procedures, and chain-of-custody records.</li><li>
Support cybersecurity monitoring, detection, containment, eradication, and recovery activities within the SOC environment.</li><li>
Coordinate with SOC analysts, incident responders, threat hunters, engineers, and federal stakeholders during cyber investigations and breach response activities.</li><li>
Support continuous improvement of forensic methodologies, investigative procedures, and cybersecurity operational capabilities.</li><li>
Assist with the development and maintenance of digital forensic playbooks, standard operating procedures (SOPs), and incident handling guidance aligned with NIST SP 800-61 and NIST SP 800-86.</li><li>
Research emerging cyber threats, adversary tactics, techniques, and procedures (TTPs), and evolving forensic technologies.</li><li>
Support federal cybersecurity compliance requirements, reporting activities, and operational readiness initiatives.</li></ul><h2 class="jobSectionHeader">
Minimum Qualifications</h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Digital Forensics, Information Assurance, Information Technology, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 8 years of experience supporting digital forensics, cyber investigations, incident response, cybersecurity operations, or Security Operations Center (SOC) environments.</li><li>
Hands-on experience conducting enterprise-level forensic investigations and evidence analysis.</li><li>
Experience with forensic acquisition and analysis tools including EnCase, FTK, X-Ways, Velociraptor, Volatility, or equivalent technologies.</li><li>
Experience analyzing Windows, Linux, cloud, mobile, and network forensic artifacts.</li><li>
Knowledge of incident response methodologies, MITRE ATT&amp;CK framework, cyber kill chain concepts, and adversary TTP analysis.</li><li>
Experience supporting legal hold, e-discovery, insider threat, and regulatory investigation activities.</li><li>
Experience with SIEM, EDR, IDS/IPS, packet analysis, and security monitoring technologies.</li><li>
Strong understanding of NIST cybersecurity standards including NIST SP 800-61 and NIST SP 800-86.</li><li>
Ability to prepare technical forensic reports and present investigative findings to technical and executive stakeholders.</li><li>
Strong analytical, investigative, communication, and technical documentation skills.</li></ul><h2 class="jobSectionHeader">
Preferred Certifications</h2><ul><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
GIAC Network Forensic Analyst (GNFA)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
EnCase Certified Examiner (EnCE)</li><li>
Certified Computer Examiner (CCE)</li><li>
Certified Ethical Hacker (CEH)</li><li>
CompTIA CySA+</li><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li></ul>
6HY6JyRiD8</div>

SBA - Digital Forensics Engineer

The Amatriot Group

<div><div>Cyber Threat Analyst 
5 Year DoJ Contract | Chantilly, VA 
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in 
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in 
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion 
investigation, host-based forensic analysis, network traffic analysis, and attribution support 
within a highly sensitive operational environment. The ideal candidate will possess experience 
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard 
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and 
support investigative operations. 
Responsibilities 
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations. 
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments. 
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and 
unauthorized access. 
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of 
compromise. 
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative 
lead generation. 
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence. 
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes. 
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies. 
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and 
procedures (TTPs). 
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations. 
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders. 
Required Skills &amp; Experience 
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph. 
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered 
in lieu of years of experience 
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk 
o EnCase 
o Magnet AXIOM 
o X-Ways Forensics 
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis. 
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

<div>
 5 Year DoJ Contract | Chantilly, VA
 
 
 Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in
 
 
 analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in
 
 
 support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion
 
 
 investigation, host-based forensic analysis, network traffic analysis, and attribution support
 
 
 within a highly sensitive operational environment. The ideal candidate will possess experience
 
 
 analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard
 
 
 forensic and cyber analysis tools to identify malicious activity, recover artifacts, and
 
 
 support investigative operations.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Process, evaluate, and analyze digital network communications and cyber threat data to
 
 
 </li>
 </ul>
 identify malicious activity and support investigative operations.
 
 
 <ul>
 <li>
 Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and
 
 
 </li>
 </ul>
 network environments.
 
 
 <ul>
 <li>
 Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets
 
 
 </li>
 </ul>
 to identify indicators of compromise, attacker activity, persistence mechanisms, and
 
 
 unauthorized access.
 
 
 <ul>
 <li>
 Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,
 
 
 </li>
 </ul>
 software usage, command execution, credential activity, and network-based indicators of
 
 
 compromise.
 
 
 <ul>
 <li>
 Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,
 
 
 </li>
 </ul>
 and user activity across multiple data sources to support attribution and investigative
 
 
 lead generation.
 
 
 <ul>
 <li>
 Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline
 
 
 </li>
 </ul>
 execution, and other system-level forensic evidence.
 
 
 <ul>
 <li>
 Draft detailed technical reports and analytical findings based on cyber investigations
 
 
 </li>
 </ul>
 while participating in internal review and quality assurance processes.
 
 
 <ul>
 <li>
 Support development and refinement of cyber analysis processes, CONOPS, SOPs,
 
 
 </li>
 </ul>
 and investigative methodologies.
 
 
 <ul>
 <li>
 Conduct open-source and intelligence community research to maintain awareness of
 
 
 </li>
 </ul>
 emerging cyber threats, malware trends, and adversary tactics, techniques, and
 
 
 procedures (TTPs).
 
 
 <ul>
 <li>
 Collaborate with internal teams and mission partners across the intelligence community
 
 
 </li>
 </ul>
 to support tactical and strategic cyber operations.
 
 
 <ul>
 <li>
 Provide operational updates and analytical findings to leadership and investigative
 
 
 </li>
 </ul>
 stakeholders.
 
 
 
 Required Skills &amp; Experience
 
 
 
 <ul>
 <li>
 Active Top Secret Clearance required, with willingness and ability to obtain a Counter
 
 
 </li>
 </ul>
 Intelligence (CI) Polygraph.
 
 
 <ul>
 <li>
 BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced
 
 
 </li>
 </ul>
 certifications, specialized training, or equivalent hands-on experience may be considered
 
 
 in lieu of years of experience
 
 
 <ul>
 <li>
 Experience performing host-based forensic analysis utilizing Splunk.
 </li>
 <li>
 Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.
 </li>
 <li>
 Hands-on experience with industry-standard forensic tools such as:
 </li>
 <li>
 Splunk
 </li>
 <li>
 EnCase
 </li>
 <li>
 Magnet AXIOM
 </li>
 <li>
 X-Ways Forensics
 </li>
 <li>
 Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,
 
 
 </li>
 </ul>
 and forensic artifact analysis.
 
 
 <ul>
 <li>
 Experience correlating threat indicators and investigative data to support attribution and
 
 
 </li>
 </ul>
 operational analysis.
</div>

PMHCC, INC.

<div>We offer the following excellent benefits including:<ul><li>
Mileage Reimbursement</li><li>
Public Service Loan Forgiveness verification of employment,</li><li>
Clinical and certification reimbursement</li><li>
Medical/Prescription Insurance (average of 85% paid by PMHCC),</li><li>
Vision ($200 allowance),</li><li>
Paid Time Off (12 holidays, 4 personal days, 12 sick days and 2 weeks vacation year one and 3 weeks vacation years 2-4),</li><li>
Paid Parental Leave,</li><li>
Retirement Savings Plan (5% paid to employee with a vesting period of 1 year),</li><li>
Tuition Reimbursement (up to $4,000 per calendar year),</li><li>
Dental (free to employee),</li><li>
Life and Disability (free to employee),</li><li>
Flexible Spending Accounts offered including Commuter and Health Spending accounts,</li><li>
Referral program,</li><li>
Employee Assistance Program,</li><li>
Healthy Wellness Programs</li><li>
and more!</li></ul>
Position Summary:
Community Treatment Teams (CTT) is mandated to provide service to those individuals within the mental health system who present the greatest degree of severity of symptoms as evidenced by their multiple physical, psychiatric and legal conditions; extensive use of services and lack of follow through with treatment. These individuals measure at the highest level of medical necessity as defined by the state Adult Environmental Matrix.
The ACT Teams are specialized teams that provide multidisciplinary clinical review and assessment of individuals who may be young adults, heavy users of services or actively involved in the criminal justice system and often have co-occurring behavioral health diagnoses of Mental Health and Substance Abuse.
The ACT Clinician provides a comprehensive assessment that offers treatment recommendations. The ACT Clinician provides the appropriate evidence-based therapy to participants on their case load; including but not limited to: Cognitive Behavior Therapy and Dialectic Behavior Therapy. The Clinician, as needed, uses a Harm Reduction, Motivational Interviewing and Individual Integrated Dual Diagnosed approach to engage and work with participants still active in their substance abuse. These services are required to address issues that might present a barrier to participant remaining in the community. The Clinician is also responsible for ensuring that the mission, goals and philosophy of the CTT are operationalized within the team. ACT team staff provides case management supports consistent with the Community Support Program of Philadelphia.
One of the ACT Clinicians may be assigned as the Forensic Clinician to act as the liaison with the Courts and Probation office; visit, as required, participants who are incarcerated or on probation, coordinate their discharge and provide treatment as is appropriate.
The incumbent encourages a strengths-oriented treatment/service planning that addresses the individual&rsquo;s principal needs, ensures continuity of care and enhancement of individual&rsquo;s understanding, acquisition and maintenance of independent living skills in the areas of (a) compliance with behavioral health treatment (b) interpersonal skills and social support/network building (c) acceptance of personal responsibility in recovery and (d) accountability in fulfilling their legal obligations in order to remain in the community.
Duties and Responsibilities:<ul><li>Provides comprehensive assessments for assigned individuals, including writing comprehensive reports</li><li>Participates in daily multidisciplinary team meetings to review progress on cases in order to ensure communication and a comprehensive approach to treatment, including collaborating with external teams to ensure coordination between systems; participates in group clinical supervision with the CTT Clinical Coordinator for skills enhancement</li><li>Provides input in case reviews to court/other authorities as deemed necessary and appropriate</li><li>Provides 80% of available time in individual and/or group treatment to address clinical issues of the individuals, using evidence-based practices and approaches such as: CBT, DBT, Trauma Informed Care, Motivational Interviewing, IDDT and Harm Reduction</li><li>Views individuals from a strengths-approach in preparation of treatment plans; with a focus on recovery principles</li><li>Monitors service delivery to individuals to ensure appropriate level of service given need as defined by Environmental Matrix score</li><li>Establishes networks and liaises with community service providers to resolve problems and overcome barriers to service; including attending linkage and treatment team meetings, as needed; provides advocacy mechanism to ensure that individual needs are met</li><li>Maintains and updates community resource file, particularly around behavioral and forensic resources, substance abuse and young adult population treatment resources and provides information and shares with team and CTT community</li><li>Completes all required reports and other documentation in a timely manner</li><li>Maintains compliance with all applicable behavioral health treatment standards as set by state and county funding authorities and ensures that agency standards, policy and procedures are adhered to by team members</li><li>Participates in Clinical Care, Open Forum and other required agency and external meetings; attends in-service and other training in order to meet mandated training hours</li><li>Plans and assists individuals to increase community tenure, enhance quality of life and attain highest level of independent functioning</li><li>Provides after hours work including: a) participation in weekly on call rotation schedule to permit 24 hour/7 day a week access to service; b) and participation in evening and weekend shift work schedules required for delivery of services to CTT&rsquo;s caseload</li><li>If assigned as Forensic Clinician, will act as liaison with the Courts and Probation Office. Visit participants that are incarcerated; as required. Coordinate discharge and provide treatment as required</li></ul>
Skills Required:
Must have excellent verbal and written communication skills, ability to work well with people, have good, creative problem solving skills; excellent clinical skills including assessment, individual and group therapy, knowledge of behavioral health and criminal justice systems, community resources; computers skills; be able to work independently as well as part of a team, flexible and adaptive in handling changing priorities in a fast paced work environment, able to work extended hours as may be required to complete projects.
Education and Experience:
Master&rsquo;s degree in generally recognized clinical discipline including, but not limited to, Psychiatry, Social Work, Psychology, Nursing, Rehabilitation, Counseling, or Activity Therapies with at least two (2) years of experience in clinical assessment and therapeutic work. Expertise preferred in various therapeutic treatment modalities and one or more of the following areas: Criminal Justice, substance abuse or geriatric issues. (Agency provides clinical training in EBPs targeting SMI/SED).
Essential Functions:
Must have a valid driver&rsquo;s license, auto insurance and use of a vehicle for work and on-call; ability to work in a team environment and share office space; ability to work evenings and weekends in meeting responsibilities.
Equal Opportunity Employment:
PMHCC, Inc. is committed to equal opportunity. It is our policy to support equal employment for all employees and applicants without regard to race, religion, color, sex, sexual preferences, age, national origin, disability, behavioral health status, military status or any other characteristic protected by law.
Americans with Disabilities Act:
Employees as well as applicants who are currently, or become disabled, must be able to perform the functions of the job with either reasonable accommodation or unaided. PMHCC, Inc. will examine reasonable accommodations on a case by case basis in accordance with the law.</div>

ACT Forensic Clinician

State of West Virginia

<div><div><div><h2 class="jobSectionHeader">Nature of Work</h2></div>
<div>Under limited supervision, this position performs advanced accounting and auditing functions for the Office of Accounting. This role serves as a primary liaison for vendor relations, resolving complex payment disputes through account reconciliation and financial research. The incumbent is responsible for identifying procurement and posting errors within wvOASIS, preparing necessary adjusting entries as well as providing high-level analytical support. Furthermore, this position plays a role in the implementation of the wvOASIS travel system by assisting Accounts Payable staff with the development of policies, interpretation of procedures , and generating critical financial reports.</div> 

<div><h2 class="jobSectionHeader">Minimum Qualifications</h2></div>
<div><div>Training: Bachelor's degree from an accredited college or university with at least 24 semester hours in accounting.</div><div>
AND</div><div>
Experience: Four (4) years of full-time or equivalent part-time paid experience in professional accounting, statutory accounting, auditing work, forensic accounting, public accounting, investigative and/or forensic auditing, certified fraud examining, or other directly related accounting.</div><div>
OR</div><div>
Substitutions: (1) Master's degree in accounting may substitute for two (2) years of the required experience. (2) Certification or registration as a Public Accountant in West Virginia may be substituted for the training and two (2) years of the required experience.</div><div></div><div> 
Preference will be given to applicants holding a Certified Fraud Examiner (CFE), Certified Forensic Accountant (CFA), Certified Valuation Analyst (CVA), or applicants who have completed a graduate certificate program in forensic accounting and fraud investigation.</div></div> 

<div><h2 class="jobSectionHeader">Other Information</h2></div> 
<div> 
<div>An additional one (1) year of experience in accounting, auditing, bookkeeping, and/or finance may substitute for the required accounting semester hours at the rate of one (1) year of experience for every thirty semester hours.</div></div></div></div>

Accountant/Auditor 4

STC Bahrain

stc Bahrain provides telecommunications and digital services across Bahrain.At stc Bahrain, cybersecurity roles usually sit within Business Products &amp; Solutions / ICT / SOC (Security Operations / Enterprise Security) teams.Core Responsibilities:Depending on level (SOC Analyst, Engineer, or Specialist), typical duties include:1. Threat Monitoring &amp; DetectionMonitor security alerts from SIEM tools and SOC systemsDetect suspicious network activity and cyber threatsAnalyze logs from servers, endpoints, and cloud systems2. Incident ResponseInvestigate cyber incidents (malware, phishing, breaches)Contain and escalate security threatsSupport recovery and forensic analysis3. Security OperationsMaintain firewalls, IDS/IPS, endpoint protection toolsApply security patches and updatesEnsure network and cloud security compliance4. Risk &amp; ComplianceSupport cybersecurity audits and risk assessmentsEnsure alignment with ISO 27001 and telecom security standardsDocument vulnerabilities and mitigation plans5. Enterprise &amp; Cloud Security (advanced roles)Secure cloud platforms and applicationsManage identity/access control systemsSupport Zero Trust security frameworksstc also operates a large SOC and AI-driven cybersecurity ecosystem protecting networks, cloud, and enterprise systemsSkills &amp; Requirements:Bachelor&rsquo;s in IT / Computer Science / CybersecurityCertifications (preferred):Security+ / CEH / CISSP / CCNA SecurityKnowledge of:SIEM tools (Splunk, QRadar)Firewalls, endpoint security, IDS/IPSStrong analytical and incident handling skillsUnderstanding of telecom or enterprise networks is a plusPay: From RO1,000.000 per monthWork Location: In person

Cybersecurity (stc Bahrain)

Eli Lilly

<div>At Lilly, we unite caring with discovery to make life better for people around the world. We are a global healthcare leader headquartered in Indianapolis, Indiana. Our employees around the world work to discover and bring life-changing medicines to those who need them, improve the understanding and management of disease, and give back to our communities through philanthropy and volunteerism. We give our best effort to our work, and we put people first. We&rsquo;re looking for people who are determined to make life better for people around the world.
The Cyber Threat Intelligence (CTI) Lead Analyst leads one of the eight functional teams within Global Cyber Defense Operations (GCDO). The role directs the strategy, operations, and continued maturation of Lilly's Cyber Threat Intelligence function &mdash; covering threat actor tracking and attribution, brand and executive protection, intelligence sharing collaborators, and the integration of intelligence into detection, response, and proactive defense across GCDO.
This is a player/coach role. The CTI Lead Analyst is expected to maintain personal technical depth in threat analysis and set the example of the standard on the hardest analytical work, while simultaneously shaping the strategy of the function, developing the analyst team, and representing GCDO across multi-functional and external forums. Candidates should expect to spend their time across both the technical and strategic dimensions of the role rather than choosing one.
What You Will Do:<ul><li>
Function Strategy and Maturation: Lead the continued development and maturation of the Cyber Threat Intelligence function, advancing it from intelligence consumer to intelligence producer and contributor across the pharmaceutical industry and the broader cyber community.</li><li>
Hands-on Technical Leadership (Player/Coach): Maintain personal technical proficiency in threat analysis, attribution, and intelligence tradecraft. Be the example on complex analytical work, set the technical bar for the team, and remain credible at the keyboard while developing analyst capability.</li><li>
Threat Actor Tracking and Attribution: Direct the threat actor tracking and attribution program as a multi-functional Cybersecurity capability &mdash; championing adoption across response, detection, architecture, platforms, threat mitigation, identity, and other defensive functions, while remaining accountable for the program's outputs, methodology, and long-term maturation. Maintain alignment between internally tracked activity clusters and industry-recognized threat actor designations to support shared understanding across the security community. Ensure the program produces actionable intelligence that informs detection, response, and strategic decisions across the enterprise.</li><li>
Brand and Executive Protection: Lead the cyber threat intelligence components of brand and executive protection, in close coordination with Corporate Security, Legal, the Brand Office, and other partners. Drive multi-functional governance to reduce duplication and improve coverage across protective monitoring services.</li><li>
Partner Collaboration: Develop and maintain strong working relationships with key partners across Cybersecurity, Corporate Security, HR, Legal, the Brand Office, Ethics &amp; Compliance, and Tech@Lilly. Represent GCDO and the CTI function in multi-functional forums where intelligence drives prioritization.</li><li>
Intelligence Sharing and Industry Engagement: Strengthen Lilly's role as an active contributor in pharmaceutical-sector and cross-industry intelligence sharing communities. Direct analyst engagement in intelligence sharing collaborators and ensure Lilly contributes high-value research at a cadence consistent with peer organizations.</li><li>
Team Leadership and Development: Lead a team of cyber threat intelligence analysts. Provide direction, mentorship, and structured development. Build a high-performing team with clear succession depth across analyst tradecraft, brand protection, and strategic intelligence.</li><li>
Tooling and Capability Enhancement: Direct the evaluation, introduction, and integration of capabilities supporting the CTI mission. Ensure intelligence is operationalized into automated enrichment, detection, and response workflows across the GCDO toolchain.</li><li>
Incident Response Support: Provide intelligence-driven support to incident response investigations, particularly for sophisticated and targeted activity. Ensure CTI insights inform the full response lifecycle from triage through after-action review.</li><li>
Training, Awareness, and Communication: Develop and deliver training and awareness programs that improve the organization's understanding of the external threat landscape. Communicate intelligence findings in formats appropriate for technical analysts, operational leaders, and senior leaders.</li></ul>
Your Minimum Basic Qualifications<ul><li>
HS Diploma/GED required</li><li>
7+ years of shown experience in Cybersecurity, including hands on cyber threat intelligence work</li><li>
Demonstrated experience materially contributing to threat actor tracking, attribution, and analytical methods that directly inform defensive decisions.</li><li>
Evidence of skills in areas e.g., malware analysis and/or reverse engineering, and campaign tracking to understand adversary objectives, techniques, and patterns.
</li><li>Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.</li></ul>
Additional Skills / Preferences<ul><li>
Proven ability to operate as a player/coach &mdash; maintaining technical depth while leading a team and shaping strategy</li><li>
Strong analytical and problem-solving skills, with a track record of producing intelligence that drives decisions</li><li>
Experience leading or significantly contributing to a threat actor tracking, attribution, or intelligence analysis program</li><li>
Experience working across brand protection, executive protection, or related multi-functional domains is preferred</li><li>
Clear and confident communicator, with the ability to translate technical intelligence for technical, operational, and executive audiences</li><li>
Ability to work independently and lead through influence across organizational boundaries</li><li>
High level of integrity and ethical standards; awareness of laws, regulations, policies, and ethics as they relate to cybersecurity, privacy, and intelligence work</li><li>
Relevant certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA)</li></ul>
Additional Information
Due to the global nature of this position, some international travel may be required.
This position may be filled with a remote worker. Remote workers may be asked to travel based on business needs, which would require discussion and approval from the employee's supervisor.
Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.
Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status. 
Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia Network, Black Employees at Lilly, Chinese Culture Network, Japanese International Leadership Network (JILN), Lilly India Network, Organization of Latinx at Lilly (OLA), PRIDE (LGBTQ+ Allies), Veterans Leadership Network (VLN), Women&rsquo;s Initiative for Leading at Lilly (WILL), enAble (for people with disabilities). Learn more about all of our groups.
Actual compensation will depend on a candidate&rsquo;s education, experience, skills, and geographic location. The anticipated wage for this position is
$162,000 - $268,400
Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly&rsquo;s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.
#WeAreLilly</div>

Cyber Threat Intelligence - Lead Analyst

Search 2188+ Forensic analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

2188 forensic analyst jobs Near Me

SBA - Digital Forensics Engineer

Cyber Threat Analyst

Cyber Threat Analyst

ACT Forensic Clinician

Accountant/Auditor 4

Cybersecurity (stc Bahrain)

Cyber Threat Intelligence - Lead Analyst