threat intelligence analyst

Alignerr

<div>
 
 Threat Intelligence Analyst (AI Training)
 
 
 
 
 About The Role
 
 
 
 Your threat intelligence skills are in demand &mdash; not just in the SOC, but on the frontier of AI development. At Alignerr, we partner with the world's leading AI research labs to build and train cutting-edge AI models. We're looking for experienced threat intelligence analysts to help shape how AI understands, reasons about, and communicates real-world cyber threats.
 
 
 This is a unique opportunity to apply your hands-on knowledge of adversary behavior, TTPs, and CTI workflows to a problem that matters: making AI smarter and more accurate in the cybersecurity domain.
 
 
 <ul>
 <li>
 Organization: Alignerr
 </li>
 <li>
 Type: Hourly Contract
 </li>
 <li>
 Location: Remote
 </li>
 <li>
 Commitment: 10&ndash;40 hours/week
 
 
 </li>
 </ul>
 
 What You'll Do
 
 
 
 <ul>
 <li>
 Analyze and classify threat reports, adversary campaigns, and attacker behavior for use in AI training datasets
 </li>
 <li>
 Evaluate indicators of compromise, TTPs, and end-to-end attack narratives for accuracy and real-world plausibility
 </li>
 <li>
 Generate, structure, and validate threat intelligence data used to train and benchmark AI systems
 </li>
 <li>
 Review AI-generated cybersecurity outputs and assess them for technical accuracy, realism, and consistency
 </li>
 <li>
 Apply your field knowledge to distinguish authentic attacker behavior from noise, fabrications, or low-quality data
 
 
 </li>
 </ul>
 
 Who You Are
 
 
 
 <ul>
 <li>
 2+ years of experience in threat intelligence, SOC analysis, or security research
 </li>
 <li>
 Familiar with MITRE ATT&amp;CK, OSINT collection methodologies, or CTI workflows
 </li>
 <li>
 Able to critically evaluate threat reports and attack narratives with a trained eye
 </li>
 <li>
 Strong analytical and written communication skills &mdash; you can explain complex threats clearly
 </li>
 <li>
 Self-motivated and comfortable working independently on async, task-based assignments
 
 
 </li>
 </ul>
 
 Nice to Have
 
 
 
 <ul>
 <li>
 Experience writing or editing threat intelligence reports or advisories
 </li>
 <li>
 Familiarity with threat actor tracking, campaign attribution, or malware analysis
 </li>
 <li>
 Background in red team operations, incident response, or digital forensics
 </li>
 <li>
 Prior exposure to AI or machine learning workflows
 
 
 </li>
 </ul>
 
 Why Join Us
 
 
 
 <ul>
 <li>
 Work directly on frontier AI systems alongside top research labs
 </li>
 <li>
 Fully remote and flexible &mdash; work on your own schedule, on your own terms
 </li>
 <li>
 Freelance autonomy with meaningful, intellectually engaging work
 </li>
 <li>
 Apply deep domain expertise in a high-impact, emerging field
 </li>
 <li>
 Potential for ongoing work and contract extension as projects grow
 </li>
 </ul>
</div>

Threat Intelligence Analyst

Peraton

<div><div><h5 class="jobSectionHeader">ABOUT PERATON</h5>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</div><div><h5 class="jobSectionHeader">
ABOUT THE ROLE</h5><div><div>
We are seeking a highly skilled and innovative Threat Intelligence Analyst to join our team in the greater DMV area, supporting the Army National Guard.</div><div></div><div> 
Responsibilities</div><ul><li>
Collect, fuse, and analyze threat intelligence from ACERT, DISA, ARCYBER, US‑CERT, commercial feeds, and enterprise telemetry to build an accurate threat picture for the ARNG environment.</li><li>
Map adversary TTPs to local technologies, CDAP/CHAP findings, and control gaps; prioritize detections, hunts, and mitigation actions.</li><li>
Produce and distribute threat briefs, IOCs, analytic notes, dashboards, and executive summaries to SOC, hunters, detection engineers, CIRT, DCO, and leadership.</li><li>
Develop enrichment logic, correlation rules, and intelligence‑driven detection/use cases to operationalize intelligence into SIEM/EDR/SOAR workflows.</li><li>
Validate indicators and detection logic with SOC analysts, incident responders, and engineering teams; support hunt missions and incident investigations with contextual intelligence.</li><li>
Track adversary campaigns, malware trends, vulnerability exploit patterns, and translate into mission‑focused recommendations for defensive measures.</li><li>
Maintain threat repositories, automation playbooks, and analytic artifacts to enable repeatable, machine‑readable intel workflows and situational awareness.</li><li>
Liaise with external intel partners and keep abreast of emerging tools, techniques, and reporting to inform enterprise readiness and response posture.</li></ul><div>
#ENOCS</div></div></div><div></div><div><h5 class="jobSectionHeader"> 
QUALIFICATIONS</h5><div><div>
Qualifications</div><ul><li>
Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD</li><li><div>
Clearance: Active TS/SCI clearance.</div></li><li><div>
Candidate must meet ONE of the following:</div><ul><li>
Master&rsquo;s degree or Ph.D. in Strategic Intelligence, Cybersecurity Risk Management, Computer Science, Data Science, Information Systems, Information Technology, or a related field; OR</li><li>
Relevant DoD/IC advanced training (examples: DIA Advanced Cyber Threat Analysis; National Cryptologic School advanced cyber intelligence courses; SANS FOR578); OR</li><li>
Relevant professional certification or equivalent experience (examples: CISSP; CompTIA CASP+; GIAC GCIA; GIAC GREM; CREST CCTIM).</li></ul></li><li><div>
Required experience and skills:</div><ul><li>
Cyber threat intelligence, analysis, or related analytic experience with at least 3 years performing senior TI roles supporting SOC/CIRT or DoD missions.</li><li>
Expertise mapping TTPs to MITRE ATT&amp;CK, developing IOCs, and producing decision‑grade analytic products and executive briefings.</li><li>
Proficiency with TI platforms, TIPs, SIEM/EDR integration, enrichment pipelines, and threat data automation.</li><li>
Strong analytic writing, briefing, and stakeholder engagement skills to translate intelligence into operational tasks and strategic recommendations.</li></ul></li><li><div>
Desired:</div><ul><li>
Prior experience supporting ARCYBER, NETCOM, RCC‑ARNG, or joint/IC threat intelligence operations.</li><li>
Familiarity with malware analysis, reverse‑engineering outputs, and integrating CTI into detection engineering and hunt workflows.</li></ul></li></ul><div>
#ENOCS</div></div></div><div><h5 class="jobSectionHeader">
DETAILS</h5><div>
Target Salary Range: $104,000 - $166,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</div><div>
Benefits Statement: Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</div><div>
Application Statements: The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates. By applying to this job, you are expressing interest in the role and the Company. During the review of your application, you may be required to participate in an on-camera interview, as well as participate in a process to verify your identity.
</div>
EEO: Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</div></div><div></div>

THREAT INTELLIGENCE ANALYST

Booz Allen Hamilton

<div>Cyber Threat Intelligence Analyst
The Opportunity:
We are seeking an experienced Cyber Threat Intelligence Analyst to join our Security Operations Center (SOC) team. This role supports analysis and research on latest advanced cyber threats to provide actionable threat intelligence that includes adversary indicators of compromise (IOCs), Techniques, Tactics, and Procedures (TTPs), behaviors, and trends to help defend the client agency. You will conduct analysis to profile threat actor TTPs used to infiltrate networks, systems, and assets to produce threat actor cards, profiles, or threat briefs. You&rsquo;ll report on current and emerging threats that will exploit vulnerabilities and details of the vulnerabilities to stakeholders.
You will collect, analyze, and correlate cyber threat intelligence from open-source, commercial, and government sources. You&rsquo;ll actively monitor open-source intelligence, industry reports, and internal security logs to gather threat information, then synthesize and disseminate critical insights to relevant stakeholders. You&rsquo;ll conduct tactical, operational, and strategic threat analysis in support of ongoing monitoring and investigations, identify patterns, and attribute attacks to specific actors. You will track threat actors, phishing campaigns, malware, and TTPs relevant to the agency&rsquo;s mission and technology footprint. You&rsquo;ll produce actionable reports, briefings, and indicators of compromise (IOCs) for internal stakeholders and support development of new detection rules and analytics based on evolving threats. 
 
Cyber threats are evolving. Booz Allen is committed to creating an environment where you not only keep pace with the industry, but propel it forward. With access to academic programs, certifications, and opportunities to use expert tradecraft, we&rsquo;ll continuously invest in you so you can create the career you want as you grow.
Join us. The world can&rsquo;t wait. 
 
You Have:<ul><li>
Experience as a cyber threat analyst collaborating with multiple internal and external stakeholders to gather data and intelligence, analyze, vet, and enrich the intelligence, create joint reports, and share with stakeholders</li><li>
Experience using intelligence platforms such as MISP Threat Intelligence Platform</li><li>
Knowledge of CNE and CNA tools and tradecraft along with signatures and Tactics, Techniques, and Procedures (TTPs) associated with preparation for and execution or implementation of such attacks</li><li>
Knowledge of cyber threats, open-source research, nation state actors, vulnerabilities, and cyber attacks</li><li>
Ability to prioritize and juggle multiple events or initiatives simultaneously</li><li>
Top Secret clearance</li><li>
Bachelor&rsquo;s degree and 15+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role, or 19+ years of experience in a cybersecurity threat intelligence, intelligence analysis, threat analysis, or cybersecurity role in lieu of a degree</li></ul>
Nice If You Have:<ul><li>
Experience working in a SOC or cyber operations environment</li><li>
Experience working with Splunk, including writing or understanding queries and evaluating telemetry logs</li><li>
Knowledge of current and emerging cyber adversaries and their Techniques, Tactics, and Procedures (TTPs)</li><li>
Knowledge of threat modeling and adversary tactics and techniques frameworks such as MITRE ATT&amp;CK matrices, Cyber Kill Chain, STRIDE, or PASTA</li><li>
Knowledge of Confluence and Jira</li><li>
Knowledge of ServiceNow or similar ticketing systems</li><li>
Ability to write and deliver succinct briefings, presentations, and reports to convey analysis, threat trends, threat actor profiles, indicator bulletins, vulnerability details, and defensive strategies to varied audiences</li><li>
CISSP, GCTI, GCIA, GCIH, CEH, CTIA, or equivalent Certification</li></ul>
Clearance: 
Applicants selected will be subject to a security investigation and may need to meet eligibility requirements for access to classified information; Top Secret clearance is required.
Compensation
At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen&rsquo;s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.
Salary at Booz Allen is determined by various factors, including but not limited to location, the individual&rsquo;s particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $86,800.00 to $198,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen&rsquo;s total compensation package for employees. This posting will close within 90 days from the Posting Date.
Identity Statement
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.
Candidate AI Usage Policy
AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on your own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited unless permission is explicitly provided.
Work Model 
Our people-first culture prioritizes the benefits of collaboration, whether it occurs in person or virtually. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.<ul><li>
Remote: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.</li><li>
Hybrid: If this position is listed as hybrid, you will be expected to work from a Booz Allen facility frequently, in alignment with leadership expectations and the needs of the role. You may also be required to work from or visit a customer facility.</li><li>
Onsite: If this position is listed as onsite, work will primarily be performed at a Booz Allen office or customer facility, where employees will collaborate directly with colleagues and customers as required by the role.</li></ul>
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.</div>

Cyber Threat Intelligence Analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader">Cyber Threat Intelligence Analyst Job Description</h1>
Position: Cyber Threat Intelligence Analyst 
Program: SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader">
Position Summary</h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services. 
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader">
Essential Duties and Responsibilities</h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader">
Minimum Qualifications</h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader">
Preferred Certifications</h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul>
Pw75tUj9Bf</div>

SBA - Cyber Threat Intelligence Analyst

TRM Labs

<div><h2 class="jobSectionHeader">Build a Safer World.</h2>
TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM's platforms enable investigators to trace illicit activity, build cases, and construct operating pictures of threat networks. Leading agencies and businesses worldwide rely on TRM to make the world safer and more secure.<h2 class="jobSectionHeader">
Role Overview:</h2>
The threats TRM's analysts work to disrupt aren't abstract &mdash; they fund violence, enable exploitation, and undermine global security. As a Senior Threat Intelligence Analyst, Crypto, you will drive TRM's collection, analysis, and reporting on the actors and networks behind these harms, applying threat intelligence tradecraft to identify, track, and expose adversaries operating in the crypto ecosystem.<h2 class="jobSectionHeader">
The impact you&rsquo;ll have here:</h2><ul><li>
Develop novel collection strategies and analytic methodologies to surface threat actor activity that isn't visible through conventional tooling or open databases</li><li>
Conduct proactive threat hunting across on-chain and off-chain data sources to identify emerging illicit networks before they're widely known</li><li>
Track, analyze, and report on threat actors, campaigns, and illicit networks operating in the crypto ecosystem</li><li>
Identify and assess adversary TTPs, infrastructure, and behavior to support detection and attribution efforts</li><li>
Leverage OSINT and other intelligence methods to uncover hidden threats and generate actionable insights</li><li>
Produce high-quality intelligence that reaches law enforcement and government partners worldwide</li><li>
Collaborate with data, engineering, and product teams to enhance TRM's intelligence capabilities</li><li>
Be a leading voice on the illicit use of crypto and blockchain technologies</li></ul><h2 class="jobSectionHeader">
What we&rsquo;re looking for:</h2><ul><li>
Proven experience in threat intelligence, cyber intelligence, or national security intelligence roles (this is not an entry-level position)</li><li>
Fluency in Russian, Chinese (Mandarin or Cantonese), or Arabic, with the ability to conduct research and analysis in that language, is strongly preferred and may be required in some cases. Please specify your language proficiency and any relevant experience in your application.</li><li>
A track record of generating net-new intelligence &mdash; developing original hypotheses, pursuing non-obvious investigative threads, and surfacing findings that others miss</li><li>
Working knowledge of blockchain and cryptocurrency &mdash; including how transactions work, on-chain tracing concepts, and the role of crypto in financial crime (e.g., ransomware, sanctions evasion, darknet markets)</li><li>
Experience tracking threat actors, cybercrime groups, or nation-state activity &mdash; including analysis of TTPs, infrastructure, and behavioral patterns to support attribution</li><li>
Strong analytical and communication skills with the ability to produce clear, actionable intelligence reports with high intelligence tradecraft standards.</li><li>
Ability to collaborate cross-functionally with technical and non-technical stakeholders</li><li>
Comfort operating in ambiguous, low-signal environments where the analytic path forward has to be constructed, not followed &mdash; and the ownership mindset to drive it independently</li><li>
Hands-on experience with blockchain analysis tools (e.g., Chainalysis Reactor, TRM, Elliptic) or formal cryptocurrency investigation experience</li><li>
Relevant certifications (e.g., GIAC, CEH, Chainalysis Reactor Certification) or background in cybersecurity, intelligence, or investigations</li></ul><h2 class="jobSectionHeader">
About the team:</h2><ul><li>
Our team values open communication and a collaborative work environment, where feedback and ideas are encouraged from all members.</li><li>
We prioritize flexibility and adaptability, ensuring that everyone stays aligned through regular check-ins and progress updates. Operating with a strong focus on shared goals, we work together to meet deadlines while supporting individual growth and innovation.</li><li>
We are a globally distributed team that leans heavily on asynchronous communication. While we aim for ~3&ndash;4 hours of overlap with the Pacific Time Zone, schedules are flexible and may occasionally adjust to support team collaboration.</li></ul><h2 class="jobSectionHeader">
Learn about TRM Speed in this position:</h2><ul><li>
Utilizes sound judgment and the 80/20 principle to drive rapid, high-impact outcomes.</li><li>
Demonstrates the ability to iterate quickly in response to evolving threat landscapes.</li><li>
Leverages creative problem-solving to ensure prompt and effective threat actor engagement to acquire attribution within 24 hours.</li><li>
Employs a diverse set of methodologies to scale and optimize threat intelligence production for customer needs within 72 hours.</li></ul><h3 class="jobSectionHeader"> 
Life at TRM</h3>
We are building a safer world. That promise shows up in how we work every day.
TRM moves quickly. We are a high velocity, high ownership team that expects clarity, follow-through, and impact. People who thrive here are energized by hard problems, experimentation, and continuous feedback. If something takes months elsewhere, it will ship here in days.
Our work sits at the intersection of AI, national security, and fighting crime. The problems are complex, the stakes are real, and the environment evolves quickly. The pace and intensity of the work reflect the importance of the mission. As a result, the way we operate requires a high level of ownership, adaptability, collaboration, and creative problem-solving.
At TRM, you should expect:<ul><li>
Priorities and targets to change quickly as we experiment and iterate</li><li>
Work that often requires operating with a high degree of ambiguity</li><li>
A high level of personal ownership and accountability</li><li>
Close collaboration across teams and functions</li><li>
Frequent, high-touch communication</li><li>
Creative problem solving and out-of-the-box thinking</li><li>
A pace that rewards urgency, adaptability, and outcomes</li></ul>
This environment is energizing for people who enjoy building, solving hard problems, and making progress in situations that are not always fully defined. It also requires comfort navigating ambiguity, adjusting course as new information emerges, and maintaining focus and positivity in a fast-moving and intense environment.
We also recognize that this style of operating is not for everyone. If you are primarily optimizing for predictability or a consistently balanced workload, we encourage you to use the interview process to pressure test whether this environment is truly the right fit. We want teammates who thrive here, not just survive here.
At the same time, many people find this work deeply rewarding. If you are excited by meaningful problems, motivated by ambitious goals, and energized by working alongside mission-driven colleagues, there is a good chance you will find TRM to be an exceptional place to grow and contribute. Learn more: Interviewing at TRM: How We Hire and What Success Looks Like<div> 
</div><h3 class="jobSectionHeader">
AI Fluency at TRM</h3>
AI fluency is a baseline expectation at TRM.
We believe AI meaningfully changes how top performers operate. We expect every team member to use AI to accelerate and reimagine their craft, not just automate surface tasks.
At TRM, AI fluency means you are among the top 10 percent of operators in your function in how you apply AI to:<ul><li>
Accelerate repeatable workflows</li><li>
Structure and solve problems</li><li>
Improve output quality</li><li>
Increase speed and leverage</li></ul>
You will be evaluated on applied AI fluency during the interview process.<h3 class="jobSectionHeader">
Leadership Principles</h3>
We hire and grow against three leadership principles. They&rsquo;re the standards for how we operate, treat each other, and make decisions.<ul><li>
Impact-Oriented Trailblazer: We put customers first and move with speed, focus, and adaptability. We treat every plan like an experiment &ndash; test, ship, measure, and iterate quickly.</li><li>
Master Craftsperson: We care deeply about our craft. We balance speed with high standards, own outcomes end‑to‑end, and invest in getting better everyday.</li><li>
Inspiring Colleague: We add clarity and energy, not noise. We bring humility, candor, and a one‑team mindset &mdash; giving and receiving feedback to make the team stronger.</li></ul><h3 class="jobSectionHeader">
Join our Mission</h3>
At TRM we care deeply about our craft. We are looking for individuals who want their work to matter, who experiment with speed and rigor, and who take pride in building a safer world for billions of people. If you&rsquo;re excited by TRM&rsquo;s mission but don&rsquo;t check every box, we encourage you to apply &mdash; we hire for slope, judgment, and the will to learn fast.
TRM is a Series C company with $220M in total funding, backed by Blockchain Capital, Goldman Sachs, Bessemer, Y Combinator, Thoma Bravo, and others. Headquartered in San Francisco, TRM operates as a distributed-first company with hubs in Los Angeles, San Francisco, New York, Washington D.C., London, and Singapore.<h3 class="jobSectionHeader">
Privacy Policy and Additional Information</h3>
By submitting your application, you are agreeing to allow TRM to process your personal information in accordance with the TRM Privacy Policy.
Our typical hiring cycles for specialized roles span 24 to 36 months. Accordingly, we retain your personal information for up to 36 months to evaluate your application and to consider you for current and future employment opportunities, unless you request earlier deletion or a different retention period is required or permitted by law.
To notify TRM Labs that you believe this job posting is non-compliant, please submit a report through this form. No response will be provided to inquiries unrelated to job posting compliance.
The use of AI tools of any kind (including but not limited to notetakers, interview assistants, and real-time coaching tools such as Otter.ai, Fireflies, Fathom, Cluey, or similar) during TRM interviews is not permitted without prior approval from TRM. TRM uses its own internal tools for note-taking to ensure a consistent and confidential experience for all candidates.
We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this form.<h3 class="jobSectionHeader">
Recruitment agencies</h3>
TRM Labs does not accept unsolicited agency resumes. Please do not forward resumes to TRM employees. TRM Labs is not responsible for any fees related to unsolicited resumes and will not pay fees to any third-party agency or company without a signed agreement.<h3 class="jobSectionHeader">
Learn More: Company Values | Interviewing | FAQs</h3></div>

Senior Threat Intelligence Analyst, Crypto

Eli Lilly

<div>At Lilly, we unite caring with discovery to make life better for people around the world. We are a global healthcare leader headquartered in Indianapolis, Indiana. Our employees around the world work to discover and bring life-changing medicines to those who need them, improve the understanding and management of disease, and give back to our communities through philanthropy and volunteerism. We give our best effort to our work, and we put people first. We&rsquo;re looking for people who are determined to make life better for people around the world.
The Cyber Threat Intelligence (CTI) Lead Analyst leads one of the eight functional teams within Global Cyber Defense Operations (GCDO). The role directs the strategy, operations, and continued maturation of Lilly's Cyber Threat Intelligence function &mdash; covering threat actor tracking and attribution, brand and executive protection, intelligence sharing collaborators, and the integration of intelligence into detection, response, and proactive defense across GCDO.
This is a player/coach role. The CTI Lead Analyst is expected to maintain personal technical depth in threat analysis and set the example of the standard on the hardest analytical work, while simultaneously shaping the strategy of the function, developing the analyst team, and representing GCDO across multi-functional and external forums. Candidates should expect to spend their time across both the technical and strategic dimensions of the role rather than choosing one.
What You Will Do:<ul><li>
Function Strategy and Maturation: Lead the continued development and maturation of the Cyber Threat Intelligence function, advancing it from intelligence consumer to intelligence producer and contributor across the pharmaceutical industry and the broader cyber community.</li><li>
Hands-on Technical Leadership (Player/Coach): Maintain personal technical proficiency in threat analysis, attribution, and intelligence tradecraft. Be the example on complex analytical work, set the technical bar for the team, and remain credible at the keyboard while developing analyst capability.</li><li>
Threat Actor Tracking and Attribution: Direct the threat actor tracking and attribution program as a multi-functional Cybersecurity capability &mdash; championing adoption across response, detection, architecture, platforms, threat mitigation, identity, and other defensive functions, while remaining accountable for the program's outputs, methodology, and long-term maturation. Maintain alignment between internally tracked activity clusters and industry-recognized threat actor designations to support shared understanding across the security community. Ensure the program produces actionable intelligence that informs detection, response, and strategic decisions across the enterprise.</li><li>
Brand and Executive Protection: Lead the cyber threat intelligence components of brand and executive protection, in close coordination with Corporate Security, Legal, the Brand Office, and other partners. Drive multi-functional governance to reduce duplication and improve coverage across protective monitoring services.</li><li>
Partner Collaboration: Develop and maintain strong working relationships with key partners across Cybersecurity, Corporate Security, HR, Legal, the Brand Office, Ethics &amp; Compliance, and Tech@Lilly. Represent GCDO and the CTI function in multi-functional forums where intelligence drives prioritization.</li><li>
Intelligence Sharing and Industry Engagement: Strengthen Lilly's role as an active contributor in pharmaceutical-sector and cross-industry intelligence sharing communities. Direct analyst engagement in intelligence sharing collaborators and ensure Lilly contributes high-value research at a cadence consistent with peer organizations.</li><li>
Team Leadership and Development: Lead a team of cyber threat intelligence analysts. Provide direction, mentorship, and structured development. Build a high-performing team with clear succession depth across analyst tradecraft, brand protection, and strategic intelligence.</li><li>
Tooling and Capability Enhancement: Direct the evaluation, introduction, and integration of capabilities supporting the CTI mission. Ensure intelligence is operationalized into automated enrichment, detection, and response workflows across the GCDO toolchain.</li><li>
Incident Response Support: Provide intelligence-driven support to incident response investigations, particularly for sophisticated and targeted activity. Ensure CTI insights inform the full response lifecycle from triage through after-action review.</li><li>
Training, Awareness, and Communication: Develop and deliver training and awareness programs that improve the organization's understanding of the external threat landscape. Communicate intelligence findings in formats appropriate for technical analysts, operational leaders, and senior leaders.</li></ul>
Your Minimum Basic Qualifications<ul><li>
HS Diploma/GED required</li><li>
7+ years of shown experience in Cybersecurity, including hands on cyber threat intelligence work</li><li>
Demonstrated experience materially contributing to threat actor tracking, attribution, and analytical methods that directly inform defensive decisions.</li><li>
Evidence of skills in areas e.g., malware analysis and/or reverse engineering, and campaign tracking to understand adversary objectives, techniques, and patterns.
</li><li>Qualified applicants must be authorized to work in the United States on a full-time basis. Lilly will not provide support for or sponsor work authorization or visas for this role, including but not limited to F-1 CPT, F-1 OPT, F-1 STEM OPT, J-1, H-1B, TN, O-1, E-3, H-1B1, or L-1.</li></ul>
Additional Skills / Preferences<ul><li>
Proven ability to operate as a player/coach &mdash; maintaining technical depth while leading a team and shaping strategy</li><li>
Strong analytical and problem-solving skills, with a track record of producing intelligence that drives decisions</li><li>
Experience leading or significantly contributing to a threat actor tracking, attribution, or intelligence analysis program</li><li>
Experience working across brand protection, executive protection, or related multi-functional domains is preferred</li><li>
Clear and confident communicator, with the ability to translate technical intelligence for technical, operational, and executive audiences</li><li>
Ability to work independently and lead through influence across organizational boundaries</li><li>
High level of integrity and ethical standards; awareness of laws, regulations, policies, and ethics as they relate to cybersecurity, privacy, and intelligence work</li><li>
Relevant certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA)</li></ul>
Additional Information
Due to the global nature of this position, some international travel may be required.
This position may be filled with a remote worker. Remote workers may be asked to travel based on business needs, which would require discussion and approval from the employee's supervisor.
Lilly is dedicated to helping individuals with disabilities to actively engage in the workforce, ensuring equal opportunities when vying for positions. If you require accommodation to submit a resume for a position at Lilly, please complete the accommodation request form (https://careers.lilly.com/us/en/workplace-accommodation) for further assistance. Please note this is for individuals to request an accommodation as part of the application process and any other correspondence will not receive a response.
Lilly is proud to be an EEO Employer and does not discriminate on the basis of age, race, color, religion, gender identity, sex, gender expression, sexual orientation, genetic information, ancestry, national origin, protected veteran status, disability, or any other legally protected status. 
Our employee resource groups (ERGs) offer strong support networks for their members and are open to all employees. Our current groups include: Africa, Middle East, Central Asia Network, Black Employees at Lilly, Chinese Culture Network, Japanese International Leadership Network (JILN), Lilly India Network, Organization of Latinx at Lilly (OLA), PRIDE (LGBTQ+ Allies), Veterans Leadership Network (VLN), Women&rsquo;s Initiative for Leading at Lilly (WILL), enAble (for people with disabilities). Learn more about all of our groups.
Actual compensation will depend on a candidate&rsquo;s education, experience, skills, and geographic location. The anticipated wage for this position is
$162,000 - $268,400
Full-time equivalent employees also will be eligible for a company bonus (depending, in part, on company and individual performance). In addition, Lilly offers a comprehensive benefit program to eligible employees, including eligibility to participate in a company-sponsored 401(k); pension; vacation benefits; eligibility for medical, dental, vision and prescription drug benefits; flexible benefits (e.g., healthcare and/or dependent day care flexible spending accounts); life insurance and death benefits; certain time off and leave of absence benefits; and well-being benefits (e.g., employee assistance program, fitness benefits, and employee clubs and activities).Lilly reserves the right to amend, modify, or terminate its compensation and benefit programs in its sole discretion and Lilly&rsquo;s compensation practices and guidelines will apply regarding the details of any promotion or transfer of Lilly employees.
#WeAreLilly</div>

Cyber Threat Intelligence - Lead Analyst

The Amatriot Group

<div><div>Cyber Threat Analyst 
5 Year DoJ Contract | Chantilly, VA 
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in 
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in 
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion 
investigation, host-based forensic analysis, network traffic analysis, and attribution support 
within a highly sensitive operational environment. The ideal candidate will possess experience 
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard 
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and 
support investigative operations. 
Responsibilities 
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations. 
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments. 
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and 
unauthorized access. 
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of 
compromise. 
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative 
lead generation. 
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence. 
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes. 
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies. 
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and 
procedures (TTPs). 
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations. 
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders. 
Required Skills &amp; Experience 
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph. 
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered 
in lieu of years of experience 
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk 
o EnCase 
o Magnet AXIOM 
o X-Ways Forensics 
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis. 
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

Search 4970+ Threat intelligence analyst jobs near you this May. New roles added regularly across leading industries. Apply today.