Cyber Threat Intelligence Analyst, Mid

Booz Allen Hamilton•Bethesda, MD

5d•$62,000 - $141,000

About The Position

As a cyber threat intelligence (CTI) analyst, you know how to support a Security Operations Center (SOC) by collecting, analyzing, and correlating CTI from a wide range of open‑source, commercial, government, and industry partners. This role manages and operationalizes ThreatConnect to enrich SOC investigations, identify emerging threats, and maintain high‑quality intelligence workflows. The analyst develops and disseminates actionable intelligence products such as reports, alerts, and briefings, to inform SOC operations, leadership, and mission stakeholders. The position also facilitates intelligence sharing and collaboration across interagency and cross‑industry communities such as ISACs and AIS, ensuring timely exchange of relevant threat information. Additionally, the analyst contributes to the maturity of the CTI program by conducting annual capability assessments, identifying gaps, and developing strategic roadmaps to enhance intelligence processes, tooling, and integration with SOC operations. Cyber threats are evolving. Booz Allen is committed to creating an environment where you not only keep pace with the industry, but propel it forward. With access to academic programs, certifications, and opportunities to use expert tradecraft, we’ll continuously invest in you so you can create the career you want as you grow. Join us. The world can’t wait.

Requirements

2+ years of experience in CTI, SOC support, or incident response, including intelligence analysis or threat research
Experience collecting, analyzing, and correlating intelligence from open and closed sources, including government, commercial, and industry feeds
Experience managing or administering threat intelligence platforms
Experience with intelligence sharing frameworks and communities, including ISACs, AIS, or federal information‑sharing programs
Knowledge of cyber threat actor tactics, techniques, and procedures (TTPs), and frameworks such as MITRE ATT&CK
Ability to develop actionable intelligence products such as reports, alerts, and briefings, for technical and non‑technical audiences
Ability to brief leadership and produce high‑quality analytic products
Ability to obtain and maintain a Public Trust or Suitability/Fitness determination based on client requirements
Bachelor’s degree

Nice To Haves

Experience supporting SOC investigations with threat enrichment, indicator analysis, or adversary profiling
Experience with structured analytic techniques used in intelligence analysis
Experience with ThreatConnect playbooks, indicator management, or intelligence lifecycle workflows
Experience conducting CTI program maturity assessments, gap analyses, or roadmap development
Knowledge of Zero Trust, EDR technologies, or modern enterprise security architectures
Knowledge of malware analysis fundamentals, network forensics, or threat hunting concepts
Possession of strong written and verbal communication skills
CompTIA CySA+, GIAC Cyber Threat Intelligence (GCTI), GIAC Open-Source Intelligence (GOSI), Certified Threat Intelligence Analyst (CTIA), CISSP, or similar Industry Certifications

Responsibilities

Collect, analyze, and correlate CTI from a wide range of open‑source, commercial, government, and industry partners.
Manage and operationalize ThreatConnect to enrich SOC investigations, identify emerging threats, and maintain high‑quality intelligence workflows.
Develop and disseminate actionable intelligence products such as reports, alerts, and briefings, to inform SOC operations, leadership, and mission stakeholders.
Facilitate intelligence sharing and collaboration across interagency and cross‑industry communities such as ISACs and AIS, ensuring timely exchange of relevant threat information.
Contribute to the maturity of the CTI program by conducting annual capability assessments, identifying gaps, and developing strategic roadmaps to enhance intelligence processes, tooling, and integration with SOC operations.