Senior Cyber Threat Intelligence Analyst

About the Role

Join EY's cybersecurity team as a Senior Cyber Threat Intelligence Analyst where you will play a crucial role in monitoring, analyzing, and reporting on cyber threats. This position involves developing and maintaining custom threat intelligence feeds, integrating these into SIEM platforms, and delivering detailed, client-specific intelligence reports. The role is aligned with working evening shifts to coordinate with onshore teams in EST timezone and includes on-call responsibilities for urgent, high-priority tasks.

Responsibilities

• Continuously monitor and evaluate cyber threat intelligence leveraging platforms such as ZeroFox, Digital Shadows, or comparable tools.
• Produce precise and comprehensive cybersecurity reports with a technical focus and attention to detail.
• Employ OSINT techniques including IOC validation, Domain Registrar lookups, VirusTotal, and Dark Web investigations to gather intelligence.
• Create, update, and enhance customized threat intelligence feeds using platforms like MISP alongside scripting tools such as Python, Azure, and Linux.
• Manage intelligence feeds through Anomali, ThreatQ, Cyble, Cyware, OpenCTI, MISP, and similar systems.
• Integrate feed data into SIEM solutions, primarily Microsoft Sentinel.
• Coordinate and execute takedowns of malicious domains and social media accounts as needed.
• Tailor comprehensive, in-depth reports to meet specific client requirements.
• Apply frameworks including MITRE ATT&CK, D3F3ND, and the Cyber Kill Chain in threat assessment practices.
• Use Excel and Power BI extensively for data cleaning, visualization, graph creation, VLookups, and Pivot Tables.
• Create and present clear PowerPoint presentations and reports to various stakeholders.
• Communicate effectively in English, both verbally and in writing.
• Operate independently in high-pressure situations and prioritize tasks efficiently.
• Remain available for on-call support during critical incidents.
• Collaborate actively with Managed Security Service Providers (MSSPs) on backend operations and customer-facing tasks.

Qualifications

• At least three years of experience using threat intelligence monitoring tools.
• A minimum of one year of experience in drafting detailed threat intelligence reports.
• Expertise with OSINT, IOC lookups, Domain Registrar investigations, VirusTotal, and Dark Web research.
• Proficient in scripting languages such as Python, and comfortable with Azure and Linux environments.
• Experience managing threat intelligence feeds on platforms like Anomali, ThreatQ, and MISP.
• Competent in integrating threat feeds with SIEM tools, especially Microsoft Sentinel.
• Demonstrated experience with domain and social media account takedowns.
• Strong knowledge of MITRE ATT&CK, D3F3ND frameworks, and the Cyber Kill Chain methodology.
• Excellent technical writing abilities in English.
• Proficient in Excel (data cleansing, VLookups, Pivot Tables) and Power BI for business intelligence purposes.
• Advanced skills in preparing and delivering PowerPoint presentations.
• Cybersecurity certifications such as COMPTIA, SANS GIAC, ISC, EC-Council are advantageous; specialized cyber threat intelligence certifications preferred.
• Willingness and ability to work evening shifts aligned with EST timezone and undertake on-call duties.
• Strong analytical thinking and task prioritization skills.
• Experience collaborating with MSSPs in both backend and client-facing roles.

Preferred Skills

• Familiarity with additional threat intelligence platforms is a plus.
• Advanced technical writing and analytical problem-solving capabilities.
• Ability to work autonomously and effectively as part of a team.

Additional Information

EY is committed to creating a better working world through innovation, trust, and collaboration. Our team operates globally across assurance, consulting, tax, strategy, and transaction services, supported by cutting-edge data, AI, and technology solutions. We embrace a diverse ecosystem spanning over 150 countries.