threat analyst

The Amatriot Group

<div><div>Cyber Threat Analyst<br>
5 Year DoJ Contract | Chantilly, VA<br>
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in<br>
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in<br>
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion<br>
investigation, host-based forensic analysis, network traffic analysis, and attribution support<br>
within a highly sensitive operational environment. The ideal candidate will possess experience<br>
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard<br>
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and<br>
support investigative operations.<br>
Responsibilities<br>
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations.<br>
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments.<br>
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and<br>
unauthorized access.<br>
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of<br>
compromise.<br>
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative<br>
lead generation.<br>
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence.<br>
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes.<br>
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies.<br>
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and<br>
procedures (TTPs).<br>
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations.<br>
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders.<br>
Required Skills &amp; Experience<br>
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph.<br>
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered<br>
in lieu of years of experience<br>
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk<br>
o EnCase<br>
o Magnet AXIOM<br>
o X-Ways Forensics<br>
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis.<br>
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

Deck Prism

<p>Experience: Candidates for the Insider Threat Investigative Analyst position must possess five (5) or more years demonstrated experience conducting all-source analysis or investigations in support of government or private sector Insider Threat Programs (ITP), to include counterintelligence, security, law enforcement, human resources, or other related fields. The position requires knowledge and experience in assessing risks, tracking trends, implementing best practices, identifying barriers for compliance, compiling metrics, and ensuring quality and timeliness of insider threat reports. Candidates must have excellent oral and written communication skills, conflict resolution techniques, and proven ability to perform under pressure to meet tight deadlines. Candidates should also have experience with Insider Threat databases for record-keeping, data mining, and analysis purposes.</p><p>(U) Education: Position requires individual to have earned a Bachelor&rsquo;s Degree from an accredited university or college in one of the social sciences, criminal justice, national security, or a related field. Advanced degrees in relevant technical and specialized fields, or professional certifications such as the Certified Counter-Insider Threat Professional (CCITP) or Certified Information Systems Security Professional (CISSP) is highly desirable.</p><p>(U) Duties:</p><ul><li>Conduct comprehensive all source analysis in support of a national level government Insider Threat mission.</li><li>Aggregate, analyze, and evaluate various data sources to assess risk.</li><li>Extract and organize data to build metrics, reports, case studies, and trend reports.</li><li>Conduct research to support on-going analytic insider threat efforts.</li><li>Prepare and produce situational awareness and warning reports for government representatives.</li><li>Provide written and oral presentations.</li></ul><p>Pay: $120,000.00 - $150,000.00 per year</p><p>Benefits:</p><ul><li>401(k) 5% Match</li><li>Dental insurance</li><li>Disability insurance</li><li>Health insurance</li><li>Life insurance</li><li>Paid time off</li><li>Vision insurance</li></ul><p>Work Location: In person</p>

Counterintelligence/Insider threat analyst

<div>
 5 Year DoJ Contract | Chantilly, VA
 <br/>
 <br/>
 Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in
 <br/>
 <br/>
 analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in
 <br/>
 <br/>
 support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion
 <br/>
 <br/>
 investigation, host-based forensic analysis, network traffic analysis, and attribution support
 <br/>
 <br/>
 within a highly sensitive operational environment. The ideal candidate will possess experience
 <br/>
 <br/>
 analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard
 <br/>
 <br/>
 forensic and cyber analysis tools to identify malicious activity, recover artifacts, and
 <br/>
 <br/>
 support investigative operations.
 <br/>
 <br/>
 <strong>
  Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Process, evaluate, and analyze digital network communications and cyber threat data to
   <br/>
   <br/>
  </li>
 </ul>
 identify malicious activity and support investigative operations.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and
   <br/>
   <br/>
  </li>
 </ul>
 network environments.
 <br/>
 <br/>
 <ul>
  <li>
   Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets
   <br/>
   <br/>
  </li>
 </ul>
 to identify indicators of compromise, attacker activity, persistence mechanisms, and
 <br/>
 <br/>
 unauthorized access.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,
   <br/>
   <br/>
  </li>
 </ul>
 software usage, command execution, credential activity, and network-based indicators of
 <br/>
 <br/>
 compromise.
 <br/>
 <br/>
 <ul>
  <li>
   Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,
   <br/>
   <br/>
  </li>
 </ul>
 and user activity across multiple data sources to support attribution and investigative
 <br/>
 <br/>
 lead generation.
 <br/>
 <br/>
 <ul>
  <li>
   Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline
   <br/>
   <br/>
  </li>
 </ul>
 execution, and other system-level forensic evidence.
 <br/>
 <br/>
 <ul>
  <li>
   Draft detailed technical reports and analytical findings based on cyber investigations
   <br/>
   <br/>
  </li>
 </ul>
 while participating in internal review and quality assurance processes.
 <br/>
 <br/>
 <ul>
  <li>
   Support development and refinement of cyber analysis processes, CONOPS, SOPs,
   <br/>
   <br/>
  </li>
 </ul>
 and investigative methodologies.
 <br/>
 <br/>
 <ul>
  <li>
   Conduct open-source and intelligence community research to maintain awareness of
   <br/>
   <br/>
  </li>
 </ul>
 emerging cyber threats, malware trends, and adversary tactics, techniques, and
 <br/>
 <br/>
 procedures (TTPs).
 <br/>
 <br/>
 <ul>
  <li>
   Collaborate with internal teams and mission partners across the intelligence community
   <br/>
   <br/>
  </li>
 </ul>
 to support tactical and strategic cyber operations.
 <br/>
 <br/>
 <ul>
  <li>
   Provide operational updates and analytical findings to leadership and investigative
   <br/>
   <br/>
  </li>
 </ul>
 stakeholders.
 <br/>
 <br/>
 <strong>
  Required Skills &amp; Experience
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Active Top Secret Clearance required, with willingness and ability to obtain a Counter
   <br/>
   <br/>
  </li>
 </ul>
 Intelligence (CI) Polygraph.
 <br/>
 <br/>
 <ul>
  <li>
   BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced
   <br/>
   <br/>
  </li>
 </ul>
 certifications, specialized training, or equivalent hands-on experience may be considered
 <br/>
 <br/>
 in lieu of years of experience
 <br/>
 <br/>
 <ul>
  <li>
   Experience performing host-based forensic analysis utilizing Splunk.
  </li>
  <li>
   Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.
  </li>
  <li>
   Hands-on experience with industry-standard forensic tools such as:
  </li>
  <li>
   Splunk
  </li>
  <li>
   EnCase
  </li>
  <li>
   Magnet AXIOM
  </li>
  <li>
   X-Ways Forensics
  </li>
  <li>
   Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,
   <br/>
   <br/>
  </li>
 </ul>
 and forensic artifact analysis.
 <br/>
 <br/>
 <ul>
  <li>
   Experience correlating threat indicators and investigative data to support attribution and
   <br/>
   <br/>
  </li>
 </ul>
 operational analysis.
</div>


Peraton

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
We are seeking a highly skilled and innovative Threat Intelligence Analyst to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div><br>
Responsibilities</div><ul><li>
Collect, fuse, and analyze threat intelligence from ACERT, DISA, ARCYBER, US‑CERT, commercial feeds, and enterprise telemetry to build an accurate threat picture for the ARNG environment.</li><li>
Map adversary TTPs to local technologies, CDAP/CHAP findings, and control gaps; prioritize detections, hunts, and mitigation actions.</li><li>
Produce and distribute threat briefs, IOCs, analytic notes, dashboards, and executive summaries to SOC, hunters, detection engineers, CIRT, DCO, and leadership.</li><li>
Develop enrichment logic, correlation rules, and intelligence‑driven detection/use cases to operationalize intelligence into SIEM/EDR/SOAR workflows.</li><li>
Validate indicators and detection logic with SOC analysts, incident responders, and engineering teams; support hunt missions and incident investigations with contextual intelligence.</li><li>
Track adversary campaigns, malware trends, vulnerability exploit patterns, and translate into mission‑focused recommendations for defensive measures.</li><li>
Maintain threat repositories, automation playbooks, and analytic artifacts to enable repeatable, machine‑readable intel workflows and situational awareness.</li><li>
Liaise with external intel partners and keep abreast of emerging tools, techniques, and reporting to inform enterprise readiness and response posture.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Strategic Intelligence, Cybersecurity Risk Management, Computer Science, Data Science, Information Systems, Information Technology, or a related field; OR</li><li>
Relevant DoD/IC advanced training (examples: DIA Advanced Cyber Threat Analysis; National Cryptologic School advanced cyber intelligence courses; SANS FOR578); OR</li><li>
Relevant professional certification or equivalent experience (examples: CISSP; CompTIA CASP+; GIAC GCIA; GIAC GREM; CREST CCTIM).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat intelligence, analysis, or related analytic experience with at least 3 years performing senior TI roles supporting SOC/CIRT or DoD missions.</li><li>
Expertise mapping TTPs to MITRE ATT&amp;CK, developing IOCs, and producing decision‑grade analytic products and executive briefings.</li><li>
Proficiency with TI platforms, TIPs, SIEM/EDR integration, enrichment pipelines, and threat data automation.</li><li>
Strong analytic writing, briefing, and stakeholder engagement skills to translate intelligence into operational tasks and strategic recommendations.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior experience supporting ARCYBER, NETCOM, RCC‑ARNG, or joint/IC threat intelligence operations.</li><li>
Familiarity with malware analysis, reverse‑engineering outputs, and integrating CTI into detection engineering and hunt workflows.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader"><b>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statements:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

THREAT INTELLIGENCE ANALYST

Booz Allen Hamilton

<div>Cyber Threat Intelligence Analyst<p><b>
The Opportunity</b><b>:</b></p><p>
We are seeking an experienced Cyber Threat Intelligence Analyst to join our Security Operations Center (SOC) team. This role supports analysis and research on latest advanced cyber threats to provide actionable threat intelligence that includes adversary indicators of compromise (IOCs), Techniques, Tactics, and Procedures (TTPs), behaviors, and trends to help defend the client agency. You will conduct analysis to profile threat actor TTPs used to infiltrate networks, systems, and assets to produce threat actor cards, profiles, or threat briefs. You&rsquo;ll report on current and emerging threats that will exploit vulnerabilities and details of the vulnerabilities to stakeholders.</p><p></p><p>
You will collect, analyze, and correlate cyber threat intelligence from open-source, commercial, and government sources. You&rsquo;ll actively monitor open-source intelligence, industry reports, and internal security logs to gather threat information, then synthesize and disseminate critical insights to relevant stakeholders. You&rsquo;ll conduct tactical, operational, and strategic threat analysis in support of ongoing monitoring and investigations, identify patterns, and attribute attacks to specific actors. You will track threat actors, phishing campaigns, malware, and TTPs relevant to the agency&rsquo;s mission and technology footprint. You&rsquo;ll produce actionable reports, briefings, and indicators of compromise (IOCs) for internal stakeholders and support development of new detection rules and analytics based on evolving threats.<br>
<br>
Cyber threats are evolving. Booz Allen is committed to creating an environment where you not only keep pace with the industry, but propel it forward. With access to academic programs, certifications, and opportunities to use expert tradecraft, we&rsquo;ll continuously invest in you so you can create the career you want as you grow.</p><p></p><p>
Join us. The world can&rsquo;t wait.<br>
<br>
<b>You Have:</b></p><ul><li><p>
Experience as a cyber threat analyst collaborating with multiple internal and external stakeholders to gather data and intelligence, analyze, vet, and enrich the intelligence, create joint reports, and share with stakeholders</p></li><li><p>
Experience using intelligence platforms such as MISP Threat Intelligence Platform</p></li><li><p>
Knowledge of CNE and CNA tools and tradecraft along with signatures and Tactics, Techniques, and Procedures (TTPs) associated with preparation for and execution or implementation of such attacks</p></li><li><p>
Knowledge of cyber threats, open-source research, nation state actors, vulnerabilities, and cyber attacks</p></li><li><p>
Ability to prioritize and juggle multiple events or initiatives simultaneously</p></li><li><p>
Top Secret clearance</p></li><li><p>
Bachelor&rsquo;s degree and 15+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role, or 19+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role in lieu of a degree</p></li></ul><p></p><p><b>
Nice If You Have:</b></p><ul><li><p>
Experience working in a SOC or cyber operations environment</p></li><li><p>
Experience working with Splunk, including writing or understanding queries and evaluating telemetry logs</p></li><li><p>
Knowledge of current and emerging cyber adversaries and their Techniques, Tactics, and Procedures (TTPs)</p></li><li><p>
Knowledge of threat modeling and adversary tactics and techniques frameworks such as MITRE ATT&amp;CK matrices, Cyber Kill Chain, STRIDE, or PASTA</p></li><li><p>
Knowledge of Confluence and Jira</p></li><li><p>
Knowledge of ServiceNow or similar ticketing systems</p></li><li><p>
Ability to write and deliver succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences</p></li><li><p>
CISSP, GCTI, GCIA, GCIH, CEH, CTIA, or equivalent Certification</p></li></ul><p></p><p><b>
Clearance:</b><br>
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Top Secret clearance is required.</p><p></p><p><b>
Compensation</b></p><p>
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.</p><p></p>
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.<p></p><p><b>
Identity Statement</b></p><p>
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.</p><p></p><p><b>
Candidate AI Usage Policy</b></p><p>
AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on <b>your </b>own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited <b>unless permission is explicitly provided</b>.
</p><p></p><p><b>Work Model</b><br>
Our people-first culture prioritizes the benefits of collaboration, whether it occurs in person or virtually. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.</p><ul><li><p><b>
Remote</b>: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.</p></li><li><p><b>
Hybrid</b>: If this position is listed as hybrid, you will be expected to work from a Booz Allen facility frequently, in alignment with leadership expectations and the needs of the role. You may also be required to work from or visit a customer facility.</p></li><li><p><b>
Onsite</b>: If this position is listed as onsite, work will primarily be performed at a Booz Allen office or customer facility, where employees will collaborate directly with colleagues and customers as required by the role.</p></li></ul><p></p><p><b>
Commitment to Non-Discrimination</b></p><p>
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</p></div><p></p>

Cyber Threat Intelligence Analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

TRM Labs

<div><h2 class="jobSectionHeader"><b>Build a Safer World.</b></h2><p>
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.</p><h2 class="jobSectionHeader"><b>
Role Overview:</b></h2><p>
The threats TRM's analysts work to disrupt aren't abstract &mdash; they fund violence, enable exploitation, and undermine global security. As a <b>Senior Threat Intelligence Analyst, Crypto</b>, you will drive TRM's collection, analysis, and reporting on the actors and networks behind these harms, applying threat intelligence tradecraft to identify, track, and expose adversaries operating in the crypto ecosystem.</p><p></p><h2 class="jobSectionHeader"><b>
The impact you&rsquo;ll have here:</b></h2><ul><li><p>
Develop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databases</p></li><li><p>
Conduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely known</p></li><li><p>
Track, analyze, and report on threat actors, campaigns, and illicit networks operating in the crypto ecosystem</p></li><li><p>
Identify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution efforts</p></li><li><p>
Leverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insights</p></li><li><p>
Produce high-quality intelligence that reaches law enforcement and government partners worldwide</p></li><li><p>
Collaborate with data, engineering, and product teams to enhance TRM's intelligence capabilities</p></li><li><p>
Be a leading voice on the illicit use of crypto and blockchain technologies</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
What we&rsquo;re looking for:</b></h2><ul><li><p>
Proven experience in threat intelligence, cyber intelligence, or national security intelligence roles <i>(this is not an entry-level position)</i></p></li><li><p>
Fluency in Russian, Chinese<b> </b>(Mandarin or Cantonese), or<b> </b>Arabic, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some cases. Please specify your language proficiency and any relevant experience in your application.</p></li><li><p>
A track record of generating net-new intelligence &mdash; developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others miss</p></li><li><p>
Working knowledge of blockchain and cryptocurrency &mdash; including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)</p></li><li><p>
Experience tracking threat actors, cybercrime groups, or nation-state activity &mdash; including analysis of TTPs, infrastructure, and behavioral patterns to support attribution</p></li><li><p>
Strong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standards.</p></li><li><p>
Ability to collaborate cross-functionally with technical and non-technical stakeholders</p></li><li><p>
Comfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed &mdash; and the ownership mindset to drive it independently</p></li><li><p>
Hands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experience</p></li><li><p>
Relevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigations</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
About the team:</b></h2><ul><li><p>
Our team values open communication and a collaborative work environment, where feedback and ideas are encouraged from all members.</p></li><li><p>
We prioritize flexibility and adaptability, ensuring that everyone stays aligned through regular check-ins and progress updates. Operating with a strong focus on shared goals, we work together to meet deadlines while supporting individual growth and innovation.</p></li><li><p>
We are a globally distributed team that leans heavily on asynchronous communication. While we aim for ~3&ndash;4 hours of overlap with the Pacific Time Zone, schedules are flexible and may occasionally adjust to support team collaboration.</p></li></ul><p></p><h2 class="jobSectionHeader"><b>
Learn about TRM Speed in this position:</b></h2><ul><li><p>
Utilizes sound judgment and the 80/20 principle to drive rapid, high-impact outcomes.</p></li><li><p>
Demonstrates the ability to iterate quickly in response to evolving threat landscapes.</p></li><li><p>
Leverages creative problem-solving to ensure prompt and effective threat actor engagement to acquire attribution within 24 hours.</p></li><li><p>
Employs a diverse set of methodologies to scale and optimize threat intelligence production for customer needs within 72 hours.</p></li></ul><p></p><h3 class="jobSectionHeader"><b><br>
Life at TRM</b></h3><p>
We are building a safer world. That promise shows up in how we work every day.</p><p>
TRM moves quickly. We are a high velocity, high ownership team that expects clarity, follow-through, and impact. People who thrive here are energized by hard problems, experimentation, and continuous feedback. If something takes months elsewhere, it will ship here in days.</p><p>
Our work sits at the intersection of AI, national security, and fighting crime. The problems are complex, the stakes are real, and the environment evolves quickly. The pace and intensity of the work reflect the importance of the mission. As a result, the way we operate requires a high level of ownership, adaptability, collaboration, and creative problem-solving.</p><p>
At TRM, you should expect:</p><ul><li><p>
Priorities and targets to change quickly as we experiment and iterate</p></li><li><p>
Work that often requires operating with a high degree of ambiguity</p></li><li><p>
A high level of personal ownership and accountability</p></li><li><p>
Close collaboration across teams and functions</p></li><li><p>
Frequent, high-touch communication</p></li><li><p>
Creative problem solving and out-of-the-box thinking</p></li><li><p>
A pace that rewards urgency, adaptability, and outcomes</p></li></ul><p>
This environment is energizing for people who enjoy building, solving hard problems, and making progress in situations that are not always fully defined. It also requires comfort navigating ambiguity, adjusting course as new information emerges, and maintaining focus and positivity in a fast-moving and intense environment.</p><p>
We also recognize that this style of operating is not for everyone. If you are primarily optimizing for predictability or a consistently balanced workload, we encourage you to use the interview process to pressure test whether this environment is truly the right fit. We want teammates who thrive here, not just survive here.</p><p>
At the same time, many people find this work deeply rewarding. If you are excited by meaningful problems, motivated by ambitious goals, and energized by working alongside mission-driven colleagues, there is a good chance you will find TRM to be an exceptional place to grow and contribute. Learn more: Interviewing at TRM: How We Hire and What Success Looks Like</p><div><br>
</div><h3 class="jobSectionHeader"><b>
AI Fluency at TRM</b></h3><p>
AI fluency is a baseline expectation at TRM.</p><p>
We believe AI meaningfully changes how top performers operate. We expect every team member to use AI to accelerate and reimagine their craft, not just automate surface tasks.</p><p>
At TRM, AI fluency means you are among the top 10 percent of operators in your function in how you apply AI to:</p><ul><li><p>
Accelerate repeatable workflows</p></li><li><p>
Structure and solve problems</p></li><li><p>
Improve output quality</p></li><li><p>
Increase speed and leverage</p></li></ul><p>
You will be evaluated on applied AI fluency during the interview process.</p><p></p><h3 class="jobSectionHeader"><b>
Leadership Principles</b></h3><p>
We hire and grow against three leadership principles. They&rsquo;re the standards for how we operate, treat each other, and make decisions.</p><ul><li><p>
Impact-Oriented Trailblazer: We put customers first and move with speed, focus, and adaptability. We treat every plan like an experiment &ndash; test, ship, measure, and iterate quickly.</p></li><li><p>
Master Craftsperson: We care deeply about our craft. We balance speed with high standards, own outcomes end‑to‑end, and invest in getting better everyday.</p></li><li><p>
Inspiring Colleague: We add clarity and energy, not noise. We bring humility, candor, and a one‑team mindset &mdash; giving and receiving feedback to make the team stronger.</p></li></ul><h3 class="jobSectionHeader"><b>
Join our Mission</b></h3><p>
At TRM we care deeply about our craft. We are looking for individuals who want their work to matter, who experiment with speed and rigor, and who take pride in building a safer world for billions of people. If you&rsquo;re excited by TRM&rsquo;s mission but don&rsquo;t check every box, we encourage you to apply &mdash; we hire for slope, judgment, and the will to learn fast.</p><p>
TRM is a Series C company with $220M in total funding, backed by Blockchain Capital, Goldman Sachs, Bessemer, Y Combinator, Thoma Bravo, and others. Headquartered in San Francisco, TRM operates as a distributed-first company with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore.</p><h3 class="jobSectionHeader"><b>
Privacy Policy and Additional Information</b></h3><p>
By submitting your application, you are agreeing to allow TRM to process your personal information in accordance with the TRM Privacy Policy.</p><p>
Our typical hiring cycles for specialized roles span 24 to 36 months. Accordingly, we retain your personal information for up to 36 months to evaluate your application and to consider you for current and future employment opportunities, unless you request earlier deletion or a different retention period is required or permitted by law.</p><p>
To notify TRM Labs that you believe this job posting is non-compliant, please submit a report through this form. No response will be provided to inquiries unrelated to job posting compliance.</p><p>
The use of AI tools of any kind (including but not limited to notetakers, interview assistants, and real-time coaching tools such as Otter.ai, Fireflies, Fathom, Cluey, or similar) during TRM interviews is not permitted without prior approval from TRM. TRM uses its own internal tools for note-taking to ensure a consistent and confidential experience for all candidates.
</p><p>We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this form.</p><p></p><h3 class="jobSectionHeader"><b>
Recruitment agencies</b></h3><p>
TRM Labs does not accept unsolicited agency resumes. Please do not forward resumes to TRM employees. TRM Labs is not responsible for any fees related to unsolicited resumes and will not pay fees to any third-party agency or company without a signed agreement.</p><p></p><h3 class="jobSectionHeader"><b>
Learn More</b><b>: </b><b>Company Values</b><b> | </b><b>Interviewing</b><b> | </b><b>FAQs</b></h3></div>

Senior Threat Intelligence Analyst, Crypto

Search 2156+ Threat analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

2156 threat analyst jobs Near Me

Cyber Threat Analyst

Counterintelligence/Insider threat analyst

Cyber Threat Analyst

THREAT INTELLIGENCE ANALYST

Cyber Threat Intelligence Analyst

SBA - Cyber Threat Intelligence Analyst

Senior Threat Intelligence Analyst, Crypto