Cyber Threat Intelligence (CTI) Analyst

Sentar•Pearl City, HI

About The Position

Sentar is seeking a Cyber Threat Intelligence Analyst to evaluate adversaries, campaigns, vulnerabilities, and emerging threats relevant to customer missions and operating environments. The analyst combines external intelligence with internal security telemetry to explain events, assess potential impact, identify intelligence gaps, and recommend practical defensive actions. The role delivers tactical, operational, and strategic intelligence to security monitoring, SOC, threat hunting, incident response, detection engineering, purple team, and leadership stakeholders. Products must distinguish verified observations from analytical judgments and document sources, confidence, assumptions, and limitations. The position requires a Top Secret clearance at minimum and the ability to obtain TS/SCI. Minimum qualifications include at least five years of relevant cybersecurity or cyber intelligence experience with a bachelor's degree, or seven years with a high school diploma or GED, subject to contract education equivalencies. This includes at least two years of CTI analysis or substantive cyber threat research supporting security operations, hunting, or incident response; these periods may overlap. The role supports incident response surge operations and requires collaboration with customer, government, industry, and operational partners. Sentar describes itself as employee-owned and offers a benefits package that includes insurance options, retirement matching, paid time off, leave programs, tuition reimbursement, professional development reimbursement, and recognition programs.

Requirements

Top Secret (TS) clearance minimum and ability to obtain TS/SCI.
Bachelor's degree in a technical or managerial discipline plus at least five years of relevant cybersecurity or cyber intelligence experience, or high school diploma/GED plus at least seven years; contract education equivalencies apply.
At least two years of CTI analysis or substantive cyber threat research supporting security operations, hunting, or incident response; experience periods may overlap with the overall experience requirement.
Working knowledge of the intelligence lifecycle, requirements, collection planning, source evaluation, analytical confidence, and dissemination.
Ability to assess sources and independent corroboration; distinguish facts from assumptions; evaluate alternatives and document uncertainty.
Ability to research adversary behavior, map evidence-supported MITRE ATT&CK techniques and sub-techniques, and distinguish indicators of compromise from behavioral TTPs.
Understanding of TCP/IP, DNS, HTTP/S, email, authentication, Windows/Linux, phishing, credential abuse, persistence, command and control, and exfiltration.
Ability to query and interpret SIEM, EDR, or comparable data; correlate times, accounts, hosts, IPs, and authentication outcomes; and explain telemetry limitations.
Ability to use intelligence and research tools for indicator enrichment and validation, infrastructure research, and source attribution; equivalent tools are accepted.
Ability to write concise assessments and brief technical and nontechnical audiences on judgments, mission relevance, confidence, and actions.
Ability to collaborate with SOC, hunting, detection, or incident response staff to produce investigative leads, defensive recommendations, or testable hunt hypotheses.
Ability to protect sensitive data, follow classification and dissemination rules, maintain reproducible notes, and incorporate peer review.

Nice To Haves

Three or more years of direct CTI experience, including independently producing finished intelligence and supporting operational consumers.
Experience developing priority intelligence requirements, collection plans, actor or campaign profiles, and stakeholder feedback processes.
Experience with Recorded Future, ThreatConnect, MISP, OpenCTI, Analyst1, or comparable platforms, including indicator quality, enrichment, provenance, and lifecycle management.
Experience with Splunk SPL, Elastic query languages, Microsoft KQL, or comparable query languages to correlate external intelligence with internal telemetry.
Experience applying structured analytic techniques and frameworks such as the Diamond Model, Cyber Kill Chain, or Pyramid of Pain to specific analytical problems.
Experience supporting hypothesis-driven threat hunts using PEAK or a comparable structured methodology, including identifying required data and documenting findings and limitations.
Experience translating adversary behaviors into detection requirements or contributing to Sigma, YARA, Snort, Suricata, or platform-specific detection content, with an understanding of validation and false positives.
Ability to use Python, PowerShell, Bash, APIs, JSON, or regular expressions for enrichment, data normalization, research, or reporting automation.
Knowledge of STIX/TAXII and intelligence sharing practices, including appropriate Traffic Light Protocol handling and source restrictions.
Experience analyzing threats involving Microsoft 365, Entra ID, AWS, Azure, or comparable cloud and identity environments.
Knowledge of malware triage, sandbox reports, network forensics, and attacker infrastructure analysis sufficient to support CTI assessments.
Experience prioritizing vulnerabilities using exploitation evidence, affected assets, exposure, mission relevance, and available controls.
Relevant credentials such as GCTI, GCIH, GCIA, CySA+, CISSP, CTIA, or comparable formal intelligence training; credentials do not independently establish contract compliance.

Responsibilities

Develop and maintain priority intelligence requirements and collection plans with stakeholders, prioritizing collection and reporting against mission needs.
Evaluate government, commercial, open-source, partner, and internal reporting for source reliability, corroboration, relevance, and timeliness.
Track relevant threat actors, campaigns, infrastructure, tools, and tactics, techniques, and procedures; map supported behaviors to MITRE ATT&CK.
Correlate external reporting with endpoint, network, identity, email, and cloud telemetry to evaluate exposure and support investigations.
Produce finished intelligence assessments, alerts, actor profiles, and briefings that include key judgments, evidence, confidence, gaps, and actionable recommendations.
Translate intelligence into testable hunt hypotheses and detection requirements; identify expected artifacts, required telemetry, and validation criteria with operational teams.
Support incident response through adversary context, indicator enrichment, campaign correlation, and assessments of likely follow-on activity.
Maintain intelligence records and indicators with provenance, timestamps, confidence, relationships, handling restrictions, and review or expiration criteria.
Coordinate authorized intelligence sharing with customer, government, and industry partners while complying with applicable handling and reporting requirements.
Maintain SOPs; contribute to capability reviews, exercises, and program evaluations; assess whether intelligence improves operational decisions and defensive coverage.
Support incident response actions during surge operations.

Benefits

Voluntary medical, dental, and vision insurance, with flexible spending plan options.
Voluntary life, critical illness, accident, and long-term care insurance options.
Group term life and short- and long-term disability coverage provided to qualifying employees.
401(k) match.
Competitive PTO plan that increases quickly with years of service.
Other leave programs, including holiday schedule, bereavement, maternity, jury, and military duty leave.
Tuition reimbursement.
Professional development reimbursement.
Recognition and awards programs.
Employee ownership model.