Cybersecurity Threat Intelligence Specialist

Ascension•Remote,

4d•$105,830 - $147,521•Remote

About The Position

This role is responsible for collecting, analyzing, and synthesizing threat intelligence to support security operations. The specialist will profile threat actors, track cyber campaigns, and map adversary tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK framework. They will also manage and optimize the Threat Intelligence Platform (TIP), translate threat trends into actionable detection rules, conduct proactive threat hunts, and provide real-time intelligence support during security incidents. The role involves synthesizing complex technical data into high-impact assessments and operational insights for various stakeholders, including executive leadership.

Requirements

High School diploma equivalency with 2 years of cumulative experience OR Associate's degree/Bachelor's degree OR 4 years of applicable cumulative job specific experience required.

Nice To Haves

Advanced proficiency in developing automation scripts (e.g., Python, PowerShell) to streamline CTI workflows, automated enrichment, data parsing, and tool/API integration.
Hands-on experience with specialized external threat landscape and enrichment tools (e.g., DomainTools, Intel 471, Maltego, or VirusTotal Enterprise).
Active advanced security or threat intelligence certifications, such as GIAC Cyber Threat Intelligence (GCTI), Certified Threat Intelligence Analyst (CTIA), or GIAC Certified Forensic Analyst (GCFA).

Responsibilities

Collect, pivot, and analyze multi-source telemetry to profile threat actors, track cyber campaigns, and map adversary TTPs to the MITRE ATT&CK framework.
Manage, tune, and optimize the Threat Intelligence Platform (TIP) to ingest, score, and deduplicate IOCs.
Collaborate with SIEM/SOAR and Detection Engineering teams to translate threat trends into actionable YARA, Sigma, and SIEM rules.
Design and execute hypothesis-based threat hunting scopes and conduct retroactive hunts across data lakes and internal security platforms.
Provide real-time, context-driven intelligence support during active security incidents, delivering critical briefings on attacker infrastructure, capabilities, and intent.
Synthesize complex technical data into high-impact threat assessments, flash reports, and threat actor profiles.
Contextualize technical risks into actionable operational insights for both technical stakeholders and executive leadership.