Cybersecurity Intelligence Analyst

MidFirst Bank•Oklahoma City, OK

20d•Onsite

About The Position

Monitor external threat intelligence sources, digital risk platforms, open-source intelligence feeds and security alerts for threats relevant to MidFirst Bank. Identify, analyze and report on phishing campaigns, threat actor activity, brand impersonation, fraud-related indicators and other cyber threats. Research emerging cyber risks, vulnerabilities and attack techniques, and summarizing findings for technical and non-technical audiences. Support digital risk monitoring related to MidFirst-owned domains, brands, public-facing assets and other exposed identifiers. Review and correlate security events, alerts and available telemetry to help identify suspicious or malicious activity. Assist with triage, escalation and follow-up for security events in coordination with incident response, security operations and other Information Security functions. Support internal investigations involving email activity, user activity, suspicious communications, fraud indicators and related cyber events. Gather, analyze and document relevant findings from internal systems, intelligence sources and investigative tools. Produce timely, accurate and actionable intelligence reports, investigative summaries, briefings and alerts. Maintain awareness of threat trends affecting financial institutions and recommend practical risk-reduction measures. Support threat-hunting, process improvement and repeatable workflows related to intelligence, investigations and security monitoring. Participate in security reviews and related research efforts as needed to support the broader objectives of the Information Security team.

Requirements

Two or more years of experience in cybersecurity, threat intelligence, investigations, security operations or a closely related discipline
Working knowledge of common cyber threats, attack methods, phishing techniques, malware trends and threat actor behavior
Experience researching and analyzing cyber intelligence from open-source, commercial or internal sources
Ability to review and interpret security alerts, logs and investigative findings with sound judgment and attention to detail
Ability to evaluate information critically, identify meaningful patterns and distinguish relevant threats from background noise
Strong written and verbal communication skills with the ability to present findings clearly and professionally
Strong organizational skills and the ability to manage multiple priorities in a fast-paced environment
Ability to handle sensitive information with discretion and professionalism
Experience using Microsoft Office tools for documentation, reporting and communication
Ability to work effectively both independently and as part of a team
Minimum of 3 years of relevant US based experience

Nice To Haves

Experience supporting cyber threat intelligence, fraud investigations, incident response or SOC-related activities in a banking or financial services environment
Familiarity with threat intelligence platforms, digital risk monitoring tools, SIEM platforms, case management systems or investigative tools
Experience with phishing analysis, domain and brand monitoring, dark web monitoring or external attack surface awareness
Experience supporting email investigations, eDiscovery requests, user activity reviews or related investigative workflows
Knowledge of MITRE ATT&CK, threat intelligence frameworks and intelligence lifecycle concepts
Understanding of indicators of compromise, indicators of attack and common investigative techniques
Familiarity with vulnerability intelligence and assessing the potential business impact of emerging threats
Experience producing executive summaries, operational alerts, case notes and technical intelligence reporting
Relevant certifications such as Security+, CySA+, GCTI, GCIA, GCIH, CISSP or similar industry credentials
Experience in a regulated environment with an understanding of confidentiality, risk management and control expectations

Responsibilities

Monitor external threat intelligence sources, digital risk platforms, open-source intelligence feeds and security alerts for threats relevant to MidFirst Bank
Identify, analyze and report on phishing campaigns, threat actor activity, brand impersonation, fraud-related indicators and other cyber threats
Research emerging cyber risks, vulnerabilities and attack techniques, and summarizing findings for technical and non-technical audiences
Support digital risk monitoring related to MidFirst-owned domains, brands, public-facing assets and other exposed identifiers
Review and correlate security events, alerts and available telemetry to help identify suspicious or malicious activity
Assist with triage, escalation and follow-up for security events in coordination with incident response, security operations and other Information Security functions
Support internal investigations involving email activity, user activity, suspicious communications, fraud indicators and related cyber events
Gather, analyze and document relevant findings from internal systems, intelligence sources and investigative tools
Produce timely, accurate and actionable intelligence reports, investigative summaries, briefings and alerts
Maintain awareness of threat trends affecting financial institutions and recommend practical risk-reduction measures
Support threat-hunting, process improvement and repeatable workflows related to intelligence, investigations and security monitoring
Participate in security reviews and related research efforts as needed to support the broader objectives of the Information Security team