Cyber Threat Intelligence Analyst
About The Position
Altus Consulting is seeking Cyber Threat Intelligence Analysts to support a mission-focused Cyber Security Operations Center (CSOC) and Cyber Incident Response Team (CIRT) in a highly secure customer environment. Analysts transform security telemetry and threat information into actionable intelligence that strengthens operational awareness, threat detection, incident response, and cyber defense decision-making. The role calls for hands-on security operations experience, strong analytical skills, and the ability to connect cybersecurity operations with threat intelligence. The analyst works with data from SIEM, SOAR, IDS/IPS, network monitoring, and endpoint security platforms. They translate findings into intelligence products, threat reporting, dashboards, playbooks, and operational procedures. The position is based in Northern Virginia—Herndon/McLean, and requires an active TS/SCI clearance with Full Scope Polygraph.
Requirements
- Active TS/SCI clearance with Full Scope Polygraph is required.
- Three to five or more years of experience supporting a Security Operations Center, Cyber Defense Team, Cyber Incident Response Team, or similar cybersecurity mission environment.
- Hands-on experience with SIEM, SOAR, IDS/IPS, network monitoring, endpoint security, or related cybersecurity technologies.
- Experience working with Splunk Enterprise Security, Elastic/ELK Stack, or comparable cybersecurity analytics platforms.
- Experience conducting cyber threat analysis and producing actionable intelligence products.
- Strong understanding of adversary tactics, techniques, and procedures.
- Experience supporting incident response, cyber defense, or threat hunting activities.
- Experience developing dashboards, reports, and security visualizations.
- Experience writing technical documentation, standard operating procedures, or operational playbooks.
- Strong written and verbal communication skills, including the ability to communicate effectively with technical and non-technical audiences.
Nice To Haves
- Strong analytical, critical-thinking, and problem-solving abilities.
- Knowledge of the MITRE ATT&CK framework and adversary TTP analysis.
- Familiarity with DevSecOps concepts and secure development practices.
- Experience with EDR/XDR technologies and threat intelligence platforms such as MISP, ThreatConnect, Anomali, or Recorded Future.
- Familiarity with Python, PowerShell, or other automation and scripting technologies.
- Experience with cloud security monitoring in AWS, Microsoft Azure, or Google Cloud environments.
- Experience developing security use cases, correlation rules, and detection engineering content.
- Experience supporting Intelligence Community, Department of Defense, or Federal cybersecurity environments.
- Preferred certifications: GCTI, CTIA, GCIH, GCFA, GCIA, GCED, GMON, Splunk Enterprise Security Certified Admin, Splunk Core Power User, Elastic Certified Analyst, Elastic Certified Engineer, CISSP, Security+, or CySA+.
Responsibilities
- Analyze security data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint detection, and other cybersecurity platforms.
- Identify, track, and assess adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
- Correlate threat intelligence with security events to improve detection, triage, threat hunting, and incident response.
- Produce actionable intelligence reports, threat briefings, cyber situational awareness products, and adversary assessments for operational stakeholders.
- Develop threat profiles and intelligence products that support security operations and cyber defense decision-making.
- Integrate cyber threat intelligence into daily SOC and incident response workflows.
- Support incident investigations with contextual intelligence and adversary attribution where appropriate.
- Collaborate with security engineers, analysts, responders, and leadership to operationalize cyber threat intelligence.
- Identify intelligence gaps and recommend improvements to detection, monitoring, and response capabilities.
- Develop executive and operational dashboards using Splunk, Elastic, or related analytics platforms.
- Create visualizations communicating emerging threats, attack trends, threat actor activity, and operational metrics.
- Develop and maintain cyber defense playbooks, standard operating procedures, and analytical methodologies.
- Document threat hunting processes, incident response procedures, and CTI workflows.
- Assist with automating intelligence collection, enrichment, analysis, and reporting activities.
- Support continuous improvement initiatives that enhance cyber defense operations and mission effectiveness.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
