CTI Analyst

Fiserv•Berkeley Heights, NJ

10d•Onsite

About The Position

Calling all innovators - find your future at Fiserv. We're Fiserv, a global leader in Fintech and payments, and we move money and information in a way that moves the world. We connect financial institutions, corporations, merchants and consumers to one another millions of times a day - quickly, reliably, and securely. Any time you swipe your credit card, pay through a mobile app, or withdraw money from the bank, we're involved. If you want to make an impact on a global scale, come make a difference at Fiserv. About your role: Most threat intelligence roles end with a report. This one is built to change what happens next. As a Cyber Threat Intelligence (CTI) Analyst, you'll be a core member of our Cybersecurity Operations team, reporting to our VP of Cyber Threat Intelligence. Your job is to identify, track, and translate emerging cyber threats into intelligence that protects Fiserv's platforms, clients, data, and infrastructure – for a company that moves money and information millions of times a day. This is a highly technical CTI seat at the intersection of threat intelligence, incident response, and engineering. You'll work side by side with the SOC, Detection Engineering, Threat Hunting, Attack Surface Management, and Red and Purple Team groups, so your analysis never sits on a shelf – it becomes the detections, hunts, and priorities that come next. If you're naturally curious, love learning new things, and want to explore novel approaches to CTI – including building the tools, models, and platforms that mature a CTI program – this is the seat.

Requirements

5+ years of experience in operational or technical cyber threat intelligence; OR 5+ years of experience in threat hunting, counter-adversary operations, incident response, digital forensics, or related cybersecurity disciplines, with demonstrated knowledge of CTI methodologies and practices.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field and/or equivalent military or federal experience.
Demonstrated ability to apply the intelligence lifecycle, MITRE ATT&CK, cyber kill chain concepts, and adversary TTP analysis to real-world investigations, detections, threat hunts, and intelligence production.
Demonstrated ability to conduct threat intelligence analysis, identify attack patterns, develop intelligence assessments, correlate technical indicators, and communicate actionable intelligence to operational and executive stakeholders.
Demonstrated ability to evaluate attacker capabilities, assess organizational exposure, and put threats in context for an enterprise environment.
Experience using Threat Intelligence Platform (TIP) solutions (e.g., Anomali, OpenCTI) to conduct analysis and support intelligence workflows.
Experience working with common CTI providers (e.g., Google Threat Intelligence, Recorded Future, Flashpoint, Silobreaker, CrowdStrike).
Experience using security telemetry from network, endpoint, cloud, identity, and/or email security platforms to support analysis, investigations, and threat validation.
Strong written communication skills, with the ability to produce clear, concise, relevant intelligence products for a diverse range of stakeholders.
Strong verbal briefing skills and comfort presenting threat findings to stakeholders at all levels.

Nice To Haves

Relevant certifications such as GCTI, GCIH, GCFA, or similar.
Experience in financial services or other regulated environments.
Experience conducting malware triage, behavioral analysis, and technical assessments of the malicious tooling adversaries use.
Experience performing infrastructure investigations using passive DNS, WHOIS, certificate transparency, internet scanning, NetFlow, and/or related enrichment sources.
Experience using Python, PowerShell, KQL, SPL, or similar technologies to automate workflows.
Experience running analytical investigations on large datasets, including enrichment, correlation, visualization, and trend analysis across multiple intelligence and security data sources.
Experience using LLMs, agentic workflows, or other AI-enabled technologies to support intelligence collection, processing, analysis, and/or production.

Responsibilities

Operationalize the intelligence cycle by developing and maintaining intelligence requirements, collection requirements, collection plans, and analytic frameworks, then identifying gaps and refining the process to improve outcomes.
Produce strategic, operational, and tactical intelligence – threat assessments, campaign analyses, executive briefings, and operational advisories – that inform stakeholders and shape their decisions.
Track the threat actors, campaigns, capabilities, and attack patterns that matter most to Fiserv, and use that awareness to set operational priorities.
Partner with the SOC and Detection Engineering teams to turn adversary behavior into detection opportunities and prioritized monitoring.
Work with the Threat Hunting team to build hunt hypotheses grounded in observed adversary behaviors and trends.
Team up with Attack Surface Management to prioritize vulnerabilities using real intelligence on emerging threats, exploitation trends, and attacker adoption patterns.
Support Red and Purple Team exercises by profiling relevant threat actors so testing stays realistic and impactful.
Dig into adversary infrastructure – domains, IPs, hosting providers, certificates, and operational patterns – to uncover relationships that support investigations and intelligence production.
Help build the CTI program of the future by developing and improving intelligence tools, models, processes, and platforms.