Senior Cyber Threat Intelligence Analyst

Role Overview

We are looking for a highly qualified Senior Cyber Threat Intelligence Analyst to join our cybersecurity team, responsible for monitoring threats, producing detailed intelligence reports, and utilizing a wide range of intelligence platforms. This position requires operating in the EST timezone (evening shifts) to coordinate with onshore teams and remaining on call for urgent high-priority issues.

Key Responsibilities

• Conduct active threat intelligence monitoring using platforms like ZeroFox, Digital Shadows, or their equivalents.
• Compose thorough and technical cybersecurity reports with precision and attention to detail.
• Gather intelligence through OSINT techniques, IOC verification, domain registrar checks, VirusTotal, and dark web investigations.
• Create, maintain, and enhance custom threat intelligence feeds with tools such as MISP, leveraging Python scripting, Azure, and Linux environments.
• Manage feeds on platforms including Anomali, ThreatQ, Cyble, Cyware, OpenCTI, and MISP.
• Integrate these threat intelligence feeds into SIEM systems, with a focus on Microsoft Sentinel.
• Perform takedowns of malicious domains and social media accounts when required.
• Develop client-specific, detailed intelligence reports.
• Apply frameworks like MITRE ATT&CK, D3F3ND, and the Cyber Kill Chain to analyze threats effectively.
• Utilize Excel and Power BI for visualizing data and creating analytical charts, including Excel data cleansing functions such as VLookups and Pivot Tables.
• Prepare and present insightful PowerPoint presentations and reports to stakeholders.
• Communicate clearly in English, both verbally and in writing.
• Work autonomously under pressure, prioritize workload efficiently, and be ready for on-call duties as needed.
• Coordinate with Managed Security Service Providers for both backend tasks and client interactions.

Required Qualifications

• At least 3 years of experience with threat intelligence monitoring solutions.
• Minimum 1 year experience in crafting threat intelligence reports.
• Solid skills using OSINT, IOC lookup and validation, domain registrar queries, VirusTotal, and dark web research.
• Proficiency in scripting with Python, and working knowledge of Azure and Linux.
• Familiarity with various threat intelligence feed management platforms.
• Hands-on experience integrating threat feeds into SIEMs, particularly Microsoft Sentinel.
• Proven capability to execute domain and social media account takedowns.
• Good understanding of threat and defense frameworks—MITRE ATT&CK, D3F3ND, Cyber Kill Chain.
• Excellent English communication skills, including advanced technical writing abilities.
• Competence in Excel and/or Power BI for data visualization and manipulation.
• Strong skills in preparing and delivering PowerPoint presentations.
• Cybersecurity certifications such as COMPTIA, SANS GIAC, ISC, or EC-Council are advantageous.
• Any certifications related to cyber threat intelligence are a strong plus.
• Ability to work evening shifts aligned with EST timezone to ensure overlap with client teams.
• Strong analytical thinking and effective prioritization under pressure.
• Experience collaborating with MSSPs for backend operational and client-facing tasks.

Preferred Skills

• Familiarity with additional threat intelligence platforms beyond the core tools.
• Advanced capabilities in technical writing and reporting.
• Excellent problem-solving and analytical skills.
• Ability to work collaboratively as part of a team as well as independently.

Additional Information

EY is committed to building a better working world by driving innovative value for clients, society, and the environment. Our teams leverage cutting-edge data analytics, artificial intelligence, and advanced technologies to address today’s toughest challenges. With a global presence in over 150 countries, EY offers diverse opportunities across assurance, consulting, tax, strategy, and transaction services.