Cyber Threat Intelligence Analyst

Altus Consulting Corp•Herndon, VA

14h

About The Position

Altus Consulting is seeking Cyber Threat Intelligence Analysts to support a mission-focused Cyber Security Operations Center (CSOC) and Cyber Incident Response Team (CIRT) in a highly secure customer environment. The role transforms security telemetry and threat information into actionable intelligence that strengthens operational awareness, threat detection, incident response, and cyber defense decision-making. Analysts use hands-on security operations experience and analytical skills to connect cybersecurity operations with threat intelligence. The analyst reviews data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint security, and related platforms, and turns findings into intelligence products, reporting, dashboards, playbooks, and operational procedures. The position supports threat analysis, threat hunting, incident response, and continuous improvement of cyber defense operations. It is a full-time, mid-level position based in Northern Virginia (Herndon/McLean) requiring an active TS/SCI clearance with Full Scope Polygraph.

Requirements

Active TS/SCI clearance with polygraph is required.
Three to five or more years of experience supporting a SOC, Cyber Defense Team, Cyber Incident Response Team, or similar cybersecurity mission environment.
Hands-on experience with SIEM, SOAR, IDS/IPS, network monitoring, endpoint security, or related cybersecurity technologies.
Experience with Splunk Enterprise Security, Elastic/ELK Stack, or comparable cybersecurity analytics platforms.
Experience conducting cyber threat analysis and producing actionable intelligence products.
Strong understanding of adversary tactics, techniques, and procedures (TTPs).
Experience supporting incident response, cyber defense, or threat hunting activities.
Experience developing dashboards, reports, and security visualizations.
Experience writing technical documentation, standard operating procedures, or operational playbooks.
Strong written and verbal communication skills and ability to communicate effectively with technical and non-technical audiences.

Nice To Haves

Strong analytical, critical-thinking, and problem-solving abilities.
Knowledge of the MITRE ATT&CK framework and adversary TTP analysis.
Experience supporting threat hunting, cyber defense, incident response, or security operations activities.
Familiarity with DevSecOps concepts and secure development practices.
Experience with EDR/XDR technologies and threat intelligence platforms such as MISP, ThreatConnect, Anomali, or Recorded Future.
Familiarity with Python, PowerShell, or other automation and scripting technologies.
Experience with cloud security monitoring in AWS, Microsoft Azure, or Google Cloud environments.
Experience developing security use cases, correlation rules, and detection engineering content.
Experience supporting Intelligence Community, Department of Defense, or Federal cybersecurity environments.
Preferred certifications: GCTI, CTIA, GCIH, GCFA, GCIA, GCED, GMON, Splunk Enterprise Security Certified Admin, Splunk Core Power User, Elastic Certified Analyst, Elastic Certified Engineer, CISSP, Security+, or CySA+.

Responsibilities

Analyze security data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint detection, and other cybersecurity platforms.
Identify, track, and assess adversary tactics, techniques, and procedures (TTPs), including with frameworks such as MITRE ATT&CK.
Correlate threat intelligence with security events to improve detection, triage, threat hunting, and incident response.
Produce actionable intelligence reports, threat briefings, cyber situational awareness products, and adversary assessments for operational stakeholders.
Develop threat profiles and intelligence products to support security operations and cyber defense decisions.
Integrate cyber threat intelligence into daily SOC and incident response workflows.
Support incident investigations with contextual intelligence and adversary attribution where appropriate.
Collaborate with security engineers, analysts, responders, and leadership to operationalize cyber threat intelligence.
Identify intelligence gaps and recommend improvements to detection, monitoring, and response capabilities.
Develop executive and operational dashboards using Splunk, Elastic, or related analytics platforms.
Create visualizations communicating emerging threats, attack trends, threat actor activity, and operational metrics.
Develop and maintain cyber defense playbooks, standard operating procedures (SOPs), and analytical methodologies.
Document threat hunting processes, incident response procedures, and CTI workflows.
Assist with automation of intelligence collection, enrichment, analysis, and reporting.
Support continuous improvement initiatives that enhance cyber defense operations and mission effectiveness.