Senior Cyber Threat Intelligence Analyst

About the Role and Company

Join EY's dynamic cybersecurity team as a Senior Cyber Threat Intelligence Analyst in Bengaluru. EY is committed to shaping a better working world by delivering trusted services that address complex challenges with the power of data, AI, and advanced technology. This position offers the chance to grow in a globally connected and diverse environment, supporting client success across 150+ countries.

Key Responsibilities

• Continuously monitor and analyze cyber threat intelligence leveraging tools such as ZeroFox, Digital Shadows, or equivalent platforms.
• Produce detailed, technical cybersecurity reports with precision and clarity.
• Use OSINT techniques, IOC lookups and validation, domain registrar inquiries, VirusTotal, and Dark Web searches to gather dynamic threat information.
• Design, maintain, and enhance customized threat intelligence feeds utilizing platforms like MISP enhanced by scripting in Python, Azure environments, and Linux systems.
• Handle threat intelligence feeds through solutions such as Anomali, ThreatQ, Cyble, Cyware, OpenCTI, and MISP for comprehensive intelligence management.
• Integrate feeds into popular SIEM infrastructures, focusing on Microsoft Sentinel for streamlined alerting and investigation.
• Conduct domain and social media account takedowns to mitigate threats effectively.
• Develop bespoke and in-depth intelligence reports tailored to client-specific needs.
• Apply frameworks including MITRE ATT&CK, D3F3ND, and the Cyber Kill Chain to enhance threat analysis methodologies.
• Leverage Excel and Power BI for data visualization, including cleaning datasets, using VLookups, Pivot Tables, and creating graphs.
• Deliver PowerPoint presentations and written reports to internal and external stakeholders with strong communication capabilities.
• Operate independently under pressure, skilfully prioritizing tasks and managing workload.
• Be available on-call for critical urgent tasks to ensure timely responses.
• Collaborate closely with Managed Security Service Providers (MSSPs) to coordinate backend and client-facing activities.

Essential Qualifications and Skills

• At least three years of practical experience using threat intelligence monitoring tools.
• Minimum one year writing technical threat intelligence reports.
• Proficiency with OSINT methods, IOC validation, domain registrar lookups, VirusTotal, and Dark Web intelligence gathering.
• Experience scripting with Python and working in Azure and Linux environments.
• Familiarity managing threat intelligence feeds on platforms like Anomali, ThreatQ, Cyble, Cyware, OpenCTI, and MISP.
• Hands-on experience with integration of threat intelligence into SIEM systems, particularly Microsoft Sentinel.
• Proven track record in conducting domain and social media takedowns.
• Strong understanding of cyber threat frameworks: MITRE ATT&CK, D3F3ND, and the Cyber Kill Chain.
• Excellent command of English for technical writing, verbal communication, and presentations.
• Advanced skills in Excel data manipulation and visualization tools such as Power BI.
• Experience preparing and delivering impactful PowerPoint presentations and detailed reports.
• Cybersecurity certifications such as COMPTIA, SANS GIAC, ISC, EC-Council, or specialized cyber threat intelligence credentials are advantages.
• Ability to work evening shifts aligned with EST timezone to communicate with onshore/client teams.
• Demonstrated strong analytical capabilities and prioritization skills.
• Experience collaborating with MSSPs for both backend operations and client engagement.

Preferred Skills

• Knowledge of additional threat intelligence platforms and tools.
• Exceptional technical writing prowess and reporting expertise.
• Robust problem-solving and analytical thinking skills.
• Capability to function independently as well as collaboratively within teams.