Manager, Threat Intelligence

Kroll • United States,

7d • $120,000 - $140,000

About The Position

Kroll Cyber Threat Intelligence (CTI) is seeking a Manager to lead and develop a team of L2 and L3 Associates delivering complex intelligence and investigative services to clients globally. The Manager will also oversee the CTI summer internship program, providing structured exposure to intelligence research, investigative tradecraft, analytical methodologies and professional development.

This working-manager role connects CTI leadership with the Associate team through day-to-day management, investigative oversight, quality assurance and professional development. It combines people leadership and hands-on investigative expertise with client-facing and commercial responsibilities, including engagement scoping, proposal development, resource estimation, business development and identifying opportunities to expand CTI services.

The Manager oversees open-, deep- and dark-web investigations; complex cyber due diligence and investigative intelligence; and protective-intelligence engagements. The role also manages client engagements and deliverable quality, supports commercial growth, develops investigative capabilities and methodologies, and leads the internship program. Success includes developing CTI talent, maintaining consistent investigative quality, translating client needs into actionable intelligence and well-defined, appropriately priced engagements, and improving the scalability and maturity of Kroll CTI.

Requirements

• Approximately 4 or more years of relevant professional experience, with demonstrated progression in cyber threat intelligence, investigations, OSINT, due diligence, protective intelligence, cybercrime research or a comparable discipline.
• Prior experience supervising, mentoring or serving as a senior reviewer for analysts or investigators.
• Hands-on knowledge of open-source, deep-web and dark-web investigative methodologies.
• Working knowledge of cybercrime ecosystems, underground forums and marketplaces, ransomware and extortion operations, credential exposure and digital risk.
• Experience evaluating source reliability, information credibility and analytical confidence.
• Experience producing professional investigative reports, intelligence assessments and executive-level briefings.
• Experience interacting directly with clients and internal business stakeholders.
• Ability to scope investigative work, estimate resources and contribute to proposals or statements of work.
• Excellent written and verbal communication skills.
• Strong professional judgment and discretion when handling sensitive, confidential or privileged matters.

Nice To Haves

• Consulting or professional-services experience.
• Experience conducting or managing corporate and individual due diligence investigations.
• Protective-intelligence or executive-threat assessment experience.
• Experience supporting legal counsel or investigations involving privileged or confidential information.
• Experience applying threat intelligence during cyber incident response or other high-profile investigations.
• Experience developing junior analysts or managing internship or graduate programs.
• Familiarity with structured intelligence methodologies and analytical tradecraft.
• Experience with business development, engagement scoping, proposal development and professional-services pricing.
• Demonstrated ability to identify follow-on opportunities and develop trusted client relationships.

Responsibilities

• Provide day-to-day leadership, coaching and development for L2 and L3 Associates.
• Allocate investigative assignments according to complexity, client requirements, analyst capability, resource availability and development objectives.
• Manage workloads and priorities across concurrent client matters and internal initiatives.
• Review research, investigative methodologies, analytical judgments and written deliverables for quality.
• Set expectations for investigative rigor, documentation, source evaluation, analytical confidence and client-ready communication.
• Supervise and, where appropriate, lead complex open-, deep- and dark-web investigations involving sources such as forums, marketplaces, leak sites, illicit communities, messaging platforms and credential repositories.
• Oversee investigations involving threat actors, ransomware and extortion, leaked or stolen information, compromised credentials, fraud, executive exposure and emerging cyber threats.
• Guide analysts in developing collection plans, hypotheses, search strategies, personas, source lists, keywords and monitoring methodologies.
• Ensure findings are corroborated and assessed for source reliability, credibility, relevance and analytical confidence.
• Ensure investigative activity complies with Kroll policies, legal requirements, ethical standards and client confidentiality requirements, and maintain appropriate documentation and defensible analytical and evidentiary trails.
• Translate complex investigative findings into clear client-risk assessments and recommended actions.
• Lead CTI support for complex cyber due diligence and investigative matters in coordination with Kroll cyber, investigative, financial, legal and advisory professionals as appropriate.
• Direct cyber-risk and digital-exposure research involving organizations, executives, transactions and other subjects of interest.
• Integrate deep- and dark-web intelligence, OSINT, digital-footprint analysis and other investigative techniques into comprehensive intelligence assessments.
• Identify cyber threats, historical exposures, compromised information, threat-actor interest and other indicators that may affect transactions or client decisions.
• Translate fragmented technical and investigative information into defensible assessments for executives, investors, counsel and other decision-makers.
• Manage protective-intelligence engagements involving executives, high-net-worth individuals and others requiring enhanced security awareness or protection.
• Oversee assessment of personal information available publicly or illicitly, digital exposure, impersonation risk, social-media exposure, unusual online interest and emerging threats.
• Direct digital-footprint, threat-actor and online behavioral research for protective-intelligence requirements.
• Identify intersections between cyber, digital and potential physical risks; escalate material findings and coordinate with Kroll security, investigative and risk professionals as appropriate.
• Translate protective-intelligence findings into clear risk assessments and practical mitigation recommendations.
• Participate in client discovery and scoping discussions to establish objectives, investigative questions, threat concerns, intelligence requirements, timelines and desired outcomes.
• Advise clients and internal stakeholders on CTI capabilities and investigative methodologies.
• Translate client requirements into scopes of work defining methodology, collection requirements, deliverables, assumptions, timelines and resources.
• Develop scopes for deep- and dark-web investigations, cyber due diligence, protective intelligence, executive exposure assessments, threat-actor investigations, persistent monitoring and bespoke intelligence engagements.
• Estimate analyst hours, effort, technology requirements and staffing to support pricing and profitability.
• Participate in client presentations and explain CTI capabilities, methodologies and value to technical and executive stakeholders.
• Develop and manage the CTI summer internship program, including curriculum, learning objectives, assignments, mentors, foundational training, supervised work, check-ins, coaching, feedback and evaluations.
• Ensure internship activities comply with information-security, privacy, ethics and client-confidentiality requirements, and identify high-performing interns as potential candidates for future L2 Associate opportunities.
• Serve as a primary quality-control and escalation point for Associate-led investigations and review significant client deliverables before release.
• Participate in or lead client calls, investigative briefings and intelligence presentations as appropriate.
• Manage client expectations regarding scope, deliverables and timelines, and maintain communication with clients and internal stakeholders throughout engagements.
• Capture lessons learned and identify improvements to investigative methodologies, operational procedures and service delivery.
• Contribute to pipeline development, proposals, scoping, follow-on and recurring work, service development and profitable growth of CTI engagements.

Benefits

• Comprehensive medical, dental and vision plans.
• Generous paid time off (PTO).
• Paid company holidays.
• Generous parental and family leave.
• Life insurance, short- and long-term disability coverage, and accident protection.
• Competitive salary structures, performance-based incentives and merit-based compensation reviews.
• 401(k) plans with company matching.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed