CTI Analyst III

Nordic Healthcare Group (NHG)

11d

About The Position

The CTI Analyst Level III is required to provide the organization’s stakeholders with actionable and contextualized tactical and operational threat intelligence to support operational defense, risk management, and decision-making. This is an advanced level position. In addition to the fundamental CTI activities surrounding data collection, analysis and dissemination, this candidate will provide technical leadership and mentorship to cybersecurity teammates and stakeholders. They will serve as a senior technical contributor within the CTI function, supporting tactical and operational intelligence activities, stakeholder engagement, intelligence production, and continuous improvement of CTI workflows and deliverables. This role will manage relationships with technical and operational stakeholders to ensure intelligence requirements are understood and intelligence products are actionable. The ideal candidate will have experience supporting the healthcare industry, working within the compliance and governance structures of Payment Card Industry Compliance Data Security Standard (PCI-DSS), Health Information Trust Alliance (HITRUST), Health Insurance Portability and Accountability Act (HIPAA), NIST 800-53 / 800-61 / 800-150, and GDPR.

Requirements

Advanced knowledge of cyber threat intelligence lifecycle, including data collection, analysis (using structured analytical techniques), and intelligence dissemination.
Strong analytical, investigative, and critical thinking skills, with the ability to synthesize complex technical data into actionable intelligence.
Proficiency in using threat intelligence platforms, SIEM tools, network analysis (NETFLOW, PCAP), malware analysis (static and dynamic), and open-source intelligence (OSINT) techniques.
Deep understanding of intrusion detection/prevention systems, incident response, attack methodologies, and security operations.
Experience applying intelligence frameworks such as the Cyber Kill Chain, MITRE ATT&CK, and Analysis of Competing Hypotheses (ACH).
Excellent verbal and written communication skills for producing intelligence products and presenting findings to technical and non-technical audiences.
Demonstrated ability to mentor CTI analysts and collaborate effectively across multidisciplinary teams.
8 years of experience in cyber threat intelligence, information security, or related fields, with a focus on incident response and threat analysis.
Experience working with external intelligence partners, information sharing groups (ISACs), and public/private sector stakeholders.
Healthcare sector experience and knowledge of sector-specific threats and regulatory requirements.
High attention to detail, integrity, and ability to handle sensitive information with discretion.
Proactive, innovative, and continuously seeking to optimize CTI processes and outcomes.
Ability to work independently and manage multiple priorities in a fast-paced, dynamic environment.

Nice To Haves

Industry certifications such as CISSP, GCTI, GIAC, GCIH, CEH, GCFA, CompTIA+ or equivalent.
Familiarity with scripting, automation, and data visualization tools to enhance intelligence analysis and reporting.

Responsibilities

Collect, analyze, and disseminate actionable cyber threat intelligence (CTI) to support operational defense, Incident response, vulnerability management, risk awareness, and decision-making for the organization.
Support the daily operational execution of the CTI function, ensuring tactical and operational intelligence products align with defined CTI priorities and stakeholder requirements.
Produce comprehensive threat assessments and intelligence reports, contextualizing threats relevant to the organization, including those targeting the healthcare sector and regulated environments.
Acquire, curate, and manage threat intelligence from a range of sources, including open source, commercial feeds, dark web, and industry sharing groups.
Collaborate with internal teams (e.g., Security Operations Center, Incident Response, Risk Management) and external partners to share intelligence, coordinate responses, and drive proactive defense measures.
Mentor and provide technical leadership to junior analysts, fostering skill development and adherence to intelligence analysis standards.
Drive innovation in CTI processes, tools, and methodologies, continuously seeking opportunities to improve intelligence quality and operational impact.
Ensure CTI activities and deliverables meet compliance requirements for PCI-DSS, HITRUST, HIPAA, NIST 800-53/61/150, and GDPR.
Maintain expertise in threat actor tactics, techniques, and procedures (TTPs), emerging threats, and evolving security technologies.
Serve as a subject matter expert for tactical and operational CTI workflows, ensuring documentation, quality assurance, and process optimization.