Cyber Threat Intelligence Analyst, Associate

About the Role

We are looking for a Cyber Threat Intelligence Analyst to join our Technology team and bolster efforts in conducting technical threat analyses, monitoring cyber adversaries, and producing actionable intelligence that enhances detection, response, and risk-aware decision-making.

Our Technology division harnesses innovation to connect and empower our firm, enabling clients and colleagues to redefine markets and shape community futures.

Key Responsibilities

• Perform proactive research and analysis to uncover adversary campaigns, capabilities, infrastructure, target profiles, and adversary tactics, techniques, and procedures (TTPs) by utilizing internal data, open-source intelligence, and commercial intelligence resources.
• Monitor and investigate threat actors, malware variants, vulnerabilities, campaigns, and emerging threats while staying informed about adversary behaviors and tradecraft.
• Evaluate cyber threat intelligence alerts and incoming intelligence regarding their significance, credibility, urgency, and potential impact, escalating crucial findings appropriately.
• Produce clear and actionable intelligence reports, including tactical and technical summaries, threat assessments, investigative synopses, and intelligence briefings tailored for both operational and non-technical audiences.
• Enrich and validate threat indicators and technical artifacts using open-source tools, commercial platforms, and internal security resources, ensuring curation of high-confidence indicators of compromise (IOCs) for operational use.
• Apply analytic frameworks such as MITRE ATT&CK and the Diamond Model to analyze adversary activity, infrastructure, capabilities, and their interrelationships.
• Analyze security data sets internally and externally to detect patterns, correlations, and trends supporting investigative and intelligence objectives.
• Collaborate with threat hunting, security monitoring, incident response, detection engineering, and other cybersecurity teams to transform threat intelligence into detection opportunities, leads for investigations, mitigations, and validations of controls.
• Maintain and refresh threat profiles related to assigned responsibilities, contributing intelligence that supports proactive detection and discovery.
• Support the enhancement of CTI analytic procedures, investigative techniques, playbooks, and automation tools to elevate the efficiency and consistency of intelligence workflows.
• When appropriate, utilize scripting and data processing skills—including Python—to assist investigations, data enrichment, and analytic processes.

Candidate Profile and Requirements

• Minimum of four years experience in cyber threat intelligence, cybersecurity investigations, threat hunting, security operations, incident response, or a related cybersecurity specialty.
• Proficiency in researching cyber threat actors, malware, campaigns, vulnerabilities, and adversary TTPs across internal, open-source, and commercial intelligence sources.
• Familiarity with analytic frameworks and methodologies such as MITRE ATT&CK, the Diamond Model, intelligence lifecycle, and structured analytic techniques.
• Experience performing alert triage and investigative analysis, assessing intelligence for relevance, reliability, and potential organizational impact.
• Strong skills in report writing and communication, capable of clearly presenting evidence, assessments, confidence levels, implications, and recommendations.
• Understanding of intelligence requirements and collection management, including identifying information gaps and aligning collection efforts with priority intelligence needs.
• Experience in using SIEM, endpoint, network, threat intelligence platforms, or other security tools and the ability to interpret security telemetry to support investigations.
• Skill in enriching and analyzing technical indicators such as domains, IP addresses, URLs, file hashes, malware artifacts, and related infrastructure.
• Working knowledge of scripting or data analysis (preferably Python) for automation, enrichment, or investigative workflows.
• Strong analytical and critical-thinking abilities to synthesize diverse information sources, differentiate fact from assessment, and develop judgments based on evidence.
• Ability to collaborate efficiently across cybersecurity teams and communicate effectively with both technical and non-technical stakeholders.
• Capability to manage various investigative and intelligence tasks simultaneously while upholding attention to detail and delivering timely, high-quality analyses.

Preferred Qualifications

• Professional certifications such as GIAC Cyber Threat Intelligence (GCTI), CISSP, CASP+, or related credentials.
• Experience using threat intelligence platforms, commercial intelligence providers, OSINT tools, malware analysis platforms, or large-scale security data analysis.
• Knowledge of intelligence management, source evaluation, structured analytic techniques, or intelligence production standards.

Additional Information

Morgan Stanley is committed to diversity, equity, and inclusion in its workforce, valuing diverse experiences and backgrounds to foster an inclusive culture. Our teams are collaborative and innovative, and we invest in supporting employees' personal and professional growth across a global presence.

We provide comprehensive employee benefits and emphasize work-life balance, encouraging internal mobility for passionate and determined employees.

Our workplace reflects the diverse communities we serve, embracing wide-ranging perspectives and experiences.