Cybersecurity Operations Analyst & Cyber Threat Intelligence Lead

The Aerospace Corporation•Colorado Springs, CO

5d•$107,000 - $160,500•Onsite

About The Position

The Aerospace Corporation is seeking an experienced cybersecurity professional to serve as a Tier 2/3 Cyber Operations Analyst and lead its Cyber Threat Intelligence (CTI) program. The role handles escalated security events, advanced threat analysis, complex investigations, and the collection, analysis, production, and dissemination of threat intelligence. As a SOC subject matter expert, the successful candidate will use security tools and technical expertise to identify, analyze, and mitigate advanced cyber threats while mentoring junior analysts. The position leads CTI strategy, processes, and capabilities; develops intelligence requirements and roadmaps; manages external intelligence relationships and threat intelligence platforms; and produces intelligence products for technical, operational, and executive audiences. It also serves as an escalation point for complex alerts and incidents, leads incident response and threat hunting, integrates intelligence into detection workflows, and develops investigation playbooks and technical documentation. The selected candidate must work full-time on-site at the company's facility in Colorado Springs, Colorado. The role requires the ability to obtain and maintain a US Secret clearance, and US citizenship is required. The job is listed at Information Security Staff III, with additional experience requirements for Information Security Staff IV. The annual grade-based pay range is $107,000 to $160,500.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Intelligence Studies, or equivalent experience.
For Information Security Staff III: 3–5 years in security operations, threat analysis, incident response, or SOC environments.
For Information Security Staff III: 3 or more years in cyber threat intelligence analysis, production, and program management.
Proven experience building or managing a CTI program.
Strong background in intelligence analysis methodologies, the intelligence cycle, and structured analytic techniques.
Experience as a Tier 2/3 SOC analyst handling complex security incidents.
Experience producing intelligence products for technical, operational, and executive audiences and briefing stakeholders.
Ability to analyze threat actors, track campaigns, and assess adversary capabilities.
Advanced proficiency with SIEM platforms such as Google SecOps, QRadar, LogRhythm, or ArcSight, including custom query development.
Hands-on experience with threat intelligence platforms and OSINT tools.
Deep understanding of network protocols, traffic analysis, and advanced attack techniques.
Extensive log analysis and event correlation experience.
Strong knowledge of Windows/Linux systems, forensic artifacts, and attacker techniques.
Expertise with EDR platforms and advanced endpoint analysis.
Expert-level understanding of the MITRE ATT&CK framework.
Experience with threat intelligence frameworks such as the Diamond Model and Cyber Kill Chain.
Advanced network packet analysis skills using tools such as Wireshark and tcpdump.
Ability to analyze malicious scripts, PowerShell commands, and malware behavior.
Ability to work under pressure and manage multiple complex investigations.
Ability to obtain and maintain a US Secret clearance; US citizenship is required.

Nice To Haves

For Information Security Staff IV: 5–7 years in security operations, threat analysis, incident response, or SOC environments.
For Information Security Staff IV: 5 or more years in cyber threat intelligence analysis, production, and program management.
Certifications such as GCTI, CTIA, GCIA, GCIH, GCFA, GNFA, GMON, CySA+, or CISSP.
Prior experience as a CTI Lead, Manager, or Program Owner.
Government, military, or defense intelligence background with formal training.
Experience developing intelligence requirements and collection strategies.
Advanced proficiency with ThreatConnect, Anomali, MISP, or Recorded Future.
OSINT research, dark web monitoring, and underground forum analysis experience.
Malware analysis and reverse engineering skills.
Published threat intelligence research or conference presentations.
Scripting proficiency in Python, PowerShell, or Bash for automation and analysis.
Experience with SOAR platforms.
Cloud security operations experience with AWS, Azure, or GCP.
Experience in classified or high-security environments.
Experience with network security monitoring tools such as Zeek, Suricata, or Snort.
Participation in red team or purple team exercises.
Analyst mentoring and training experience.
Knowledge of compliance frameworks such as NIST 800-53, NIST 800-171, or CMMC.
Familiarity with IC standards such as ICD 203 and ICD 206.

Responsibilities

Lead the CTI program by establishing strategy, processes, and capabilities.
Develop the CTI roadmap, define priority intelligence requirements and intelligence requirements, and align them with organizational risk priorities.
Manage relationships with external threat intelligence partners, ISACs/ISAOs, and government agencies.
Produce strategic, operational, and tactical intelligence products, including threat assessments, adversary profiles, and campaign analyses.
Conduct all-source intelligence analysis on threat actors and emerging threats targeting the aerospace and defense sectors.
Manage threat intelligence platforms and establish intelligence workflows.
Track and profile advanced persistent threat groups and other adversaries relevant to the organization's threat landscape.
Brief leadership on threat trends, emerging risks, and intelligence-driven recommendations.
Establish metrics to demonstrate CTI program value and effectiveness.
Serve as the Tier 2/3 escalation point for complex security alerts and incidents.
Conduct in-depth investigations of sophisticated threats and advanced persistent threats.
Perform advanced threat hunting using intelligence to guide hypotheses.
Analyze alerts from SIEM, IDS, EDR, and other security technologies.
Correlate data from multiple sources to reconstruct attack timelines and determine the scope of compromise.
Lead incident response for escalated events, coordinating containment and remediation.
Integrate threat intelligence into detection workflows and develop advanced detection rules.
Analyze malware, scripts, and attacker tools to understand adversary tactics, techniques, and procedures.
Mentor Tier 1 analysts and develop their analytical skills.
Create advanced playbooks, investigation workflows, and technical documentation.
Produce detailed technical reports and executive summaries on complex threats.
Provide after-hours escalation support for critical incidents as needed.

Benefits

Comprehensive health care and wellness plans.
Paid holidays, sick time, and vacation.
Standard and alternate work schedules, including telework options.
401(k) plan with company-paid benefits of 8%, 10%, or 12% of eligible compensation based on years of service, plus matching contributions; employees are immediately eligible and vested upon hire.
Flexible spending accounts.
Variable pay program for exceptional contributions.
Relocation assistance.
Professional growth and development programs.
Education assistance programs.
Inclusive work environment built on teamwork, flexibility, and respect.