Cyber Threat Intelligence Analyst - Remote

CSAA Insurance Group, a AAA Insurer•Arizona - Home Teleworkers, AZ

3d•$122,850 - $164,000•Remote

About The Position

CSAA Insurance Group (CSAA IG), a AAA insurer, is one of the leading personal lines property and casualty insurance groups in the United States. We build innovative, human-centered solutions that help AAA members prevent, prepare for, and recover from life's uncertainties. You will join a collaborative, inclusive culture where your strengths have room to grow and your ideas can drive real impact. Step into a role where you can contribute to our shared success through meaningful work. We are actively hiring for a Cyber Threat Intelligence Analyst - Remote. The CSAA Cyber Threat Intelligence Team is responsible for identifying, analyzing, and tracking cyber threats that may impact the organization. We collect intelligence from a wide range of internal and external sources and use that information to understand threat actors, campaigns, vulnerabilities, and attacker tradecraft relevant to our environment. The successful candidate will be responsible for analyzing and contextualizing threat intelligence, identifying potential risks, and supporting security operations through actionable insights. They will help improve insight into emerging threats, support investigative efforts, and contribute to the continued development and maturity of the CTI program.

Requirements

6+ years of experience in Cyber Threat Intelligence, SOC, Incident Response, Threat Hunting, or related cybersecurity roles
Bachelor’s degree in computer science, Information Technology, or a related field, or an equivalent combination of education and experience
Deep experience operating and optimizing industry leading Threat Intelligence Platforms (TIPs)
Proven experience leveraging commercial threat intelligence providers such as Flashpoint, Recorded Future, Intel 471, ZeroFox, or comparable services to support operational intelligence requirements
Strong mastery of the intelligence lifecycle, with demonstrated ability to operationalize intelligence from collection through dissemination and action
Advanced working knowledge of the MITRE ATT&CK framework, with experience applying it to threat analysis, detection engineering, and reporting
Demonstrated experience managing and enriching IOCs, with a focus on translating intelligence into measurable detection, blocking, and mitigation outcomes
Solid understanding of SIEM, SOAR, EDR, and case management platforms, and how intelligence integrates into and enhances investigative workflows
Experience analyzing vulnerability and exploit intelligence to assess real‑world risk, likelihood of exploitation, and potential business impact
Strong written and verbal communication skills, with the ability to clearly articulate complex threat and risk concepts to both technical and non‑technical stakeholders

Nice To Haves

A teammate who values collaboration and knowledge sharing
Ability to think critically and operate effectively in ambiguous or evolving situations
Strong communication skills
A strong passion for continuous learning, with curiosity to stay current on emerging threats, techniques, and evolving security trends
A self‑starter who takes initiative, operates effectively with minimal direction, and proactively sees opportunities to improve security outcomes
Actively shapes our company culture (e.g., participating in employee resource groups, volunteering, etc.)
Lives into cultural norms (e.g., willing to have cameras when it matters: helping onboard new team members, building relationships, etc.)
Travels as needed for role, including divisional / team meetings and other in-person meetings
Fulfills business needs, which may include investing extra time, helping other teams, etc.

Responsibilities

Monitor and analyze intelligence from commercial, industry, and OSINT sources to track threat actors, campaigns, and vulnerabilities, and assess their relevance, impact, and risk to the organization
Maintain and use Threat Intelligence Platforms (TIP) and related tools to support intelligence operations, including ingestion, enrichment, tagging, and data quality
Integrate intelligence across security tools (SIEM, SOAR, case management) to support operations
Collect, enrich, and manage actionable IOCs to drive detection, blocking, and mitigation efforts across security operations
Provide real‑time intelligence context during investigations and incidents (e.g., adversary behavior, infrastructure, objectives)
Analyze vulnerability intelligence, including KEV listings and active exploitation trends, to support risk‑based vulnerability prioritization
Respond to ad hoc and time‑sensitive intelligence requests from stakeholders
Support threat hunting by developing indicators, behaviors, and hypotheses
Produce and deliver intelligence reports and briefings for technical and non‑technical audiences
Improve intelligence workflows, intake processes, RFIs, and documentation