Cyber Threat Intelligence Analyst

American Electric Power•Columbus, OH

About The Position

The Cyber Threat Intelligence (CTI) Analyst identifies, analyzes, and communicates cyber threats that may affect the organization. The role collects and assesses intelligence from internal and external sources, tracks threat actors and campaigns, develops actionable intelligence products, and supports cybersecurity operations through proactive threat identification and risk analysis. The analyst works with Security Operations, Incident Response, Threat Hunting, Detection Engineering, and business stakeholders to help the organization anticipate, detect, and respond to emerging threats. The position analyzes strategic, operational, and tactical intelligence, including threat activity, adversary tactics, techniques, and procedures, malware campaigns, vulnerabilities, and emerging attack trends. It produces intelligence reports and briefings for technical and non-technical audiences, and supports threat hunting, incident response, detection engineering, vulnerability management, and executive decision-making. The role also collaborates with government agencies, industry partners, information-sharing organizations, and cybersecurity communities. The role requires a bachelor's degree or an applicable combination of education and experience. The posting also lists alternate education and experience pathways, including an associate degree with relevant experience or a high school diploma/GED with additional relevant experience. It lists experience thresholds of seven or more years in information technology, or five or more years in security-related work. Compensation range is $116,255.00–$151,132.50, with base salary, annual bonus, long-term incentive, 401(k) match, pension, and a comprehensive benefits package. The work is classified as sedentary, involving sitting most of the time and occasional walking or standing.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Intelligence Studies, Criminal Justice, or a related field, or an equivalent combination of education and experience.
Three or more years of experience in cyber threat intelligence, security operations, incident response, threat hunting, detection engineering, vulnerability management, or cyber defense.
Experience analyzing threat actor behavior, malware activity, intrusion campaigns, and emerging cyber threats.
Understanding of intelligence analysis methodologies and cyber threat intelligence lifecycle processes.
Familiarity with MITRE ATT&CK, Cyber Kill Chain, NIST Cybersecurity Framework, and related industry frameworks.
Experience working with threat intelligence platforms, SIEM solutions, EDR tools, security monitoring platforms, and open-source intelligence sources.
Strong written and verbal communication skills, including the ability to present findings clearly to technical and executive audiences.
Critical thinking, attention to detail, and ability to assess incomplete or conflicting information.
The posting's education and experience requirements also include a bachelor's degree or associate degree with two years of relevant system administration, help desk, or security experience, or a high school diploma/GED with four years of relevant IT system administration, help desk, or security experience.
Seven or more years of information technology-related experience, or five or more years of security-related experience; military or government work experience may count toward the security-related experience.

Nice To Haves

Experience supporting critical infrastructure, energy, utility, industrial control system (ICS), or operational technology (OT) environments.
Experience integrating threat intelligence into threat hunting, incident response, or detection programs.
Knowledge of nation-state threats, ransomware groups, cybercriminal ecosystems, and emerging adversary trends.
Experience developing intelligence requirements, collection plans, and analytic products.
Familiarity with scripting or automation using Python, PowerShell, or similar languages.
Experience briefing senior leadership and executive stakeholders.
Active security clearance or eligibility to obtain one.
GIAC Cyber Threat Intelligence (GCTI) certification.
Certified Cyber Threat Intelligence Analyst (CCTIA) certification.
GIAC Certified Incident Handler (GCIH) certification.
GIAC Certified Forensic Analyst (GCFA) certification.
CompTIA Security+ certification.
CISSP certification.
Certified Threat Intelligence Analyst (CTIA) certification.
SANS FOR578 or SEC487 related coursework.

Responsibilities

Collect, analyze, and disseminate strategic, operational, and tactical cyber threat intelligence.
Monitor global cyber threat activity, threat actor developments, malware campaigns, vulnerabilities, and emerging attack trends.
Research and analyze adversary tactics, techniques, and procedures using frameworks such as MITRE ATT&CK.
Produce intelligence reports, threat assessments, executive summaries, and briefing materials for technical and non-technical audiences.
Develop and maintain intelligence requirements aligned with organizational risk and business priorities.
Analyze security logs, network traffic, and threat intelligence sources to identify threats targeting enterprise and operational technology environments.
Validate indicators of compromise and provide actionable intelligence to support detection, threat hunting, and incident response.
Support threat hunting, incident response, detection engineering, and vulnerability management through intelligence-driven analysis.
Investigate potential threats affecting enterprise, cloud, identity, third-party, and operational technology environments.
Collaborate with government agencies, industry partners, information-sharing organizations, and cybersecurity communities.
Maintain awareness of geopolitical events and assess their potential impact on cyber risk.
Track intelligence metrics and measure the effectiveness of intelligence products and recommendations.
Support executive decision-making through timely and actionable threat reporting.