Protective Intelligence Analyst- OSINT Monitoring and Triage

The Vanguard Group•Charlotte, PA

12d•Hybrid

About The Position

The Protective Intelligence Analyst’s primary focus is monitoring and triage, while also contributing to the program’s core assessment products and providing backup coverage across product lines. The analyst manages daily alert and intake queues, evaluates incoming information against established threat-screening criteria, documents dispositions, and opens cases for investigation when appropriate. The role also provides monitoring coverage during executive travel and events, maintains watchlists and intelligence feeds, and escalates developments according to defined criteria. The analyst maintains protective-intelligence trackers and metrics, conducts open-source intelligence (OSINT) collection and analysis, documents sources and findings, and contributes judgments to final assessments. The role drafts a weekly intelligence summary, processes intake acknowledgements, and follows records-handling standards. Analysts rotate through monitoring and triage, train to produce core assessment products, cross-train teammates, maintain proficiency in teammates’ specialties, and participate in dual reviews and after-action practices. The position includes participation in an on-call rotation for after-hours escalation support as the program matures, early-morning queue coverage, and occasional evening and weekend surge coverage during executive travel windows. Occasional domestic travel of less than 10% is expected. Vanguard is not offering visa sponsorship for this position. Vanguard describes its work model as hybrid for the majority of crew members, balancing flexibility with in-person learning, collaboration, and connection.

Requirements

Bachelor’s degree in criminal justice, intelligence studies, security studies, psychology, or a related field, or equivalent experience.
At least three years of related experience in intelligence analysis, GSOC/watch operations, journalism/research, military analysis, law-enforcement analysis, or a related field.
Ability to work a high-volume queue consistently and accurately, with documented decisions.
Strong OSINT skills, including locating, verifying, and assessing the credibility of information across open sources.
Ability to read concerning or threatening content professionally and escalate appropriately.
High ethical standards and discretion when handling sensitive executive and corporate information.
Excellent written and verbal communication skills, including the ability to brief senior leaders clearly and calmly under time pressure.
Ability to think critically and assess incomplete, ambiguous, or conflicting information.
No visa sponsorship is offered for this position.

Nice To Haves

Hands-on experience with threat-intelligence, alerting, or case-management platforms.
Formal training or applied experience in threat assessment, targeted-violence prevention, or intelligence analysis.
ATAP membership and active interest or progress toward obtaining the Certified Threat Manager (CTM) designation.

Responsibilities

Manage daily alert and intake queues, including vendor alert feeds, program intake channels, executive-assistant and partner referrals, and regional intelligence routing.
Triage incoming items using established threat-screening criteria; document rationale for unfounded dispositions or open cases for investigation.
Provide monitoring coverage during executive travel and event windows, assess emerging developments in real time, and escalate according to defined criteria.
Maintain watchlist hygiene and help fine-tune OSINT feeds for reliable threat identification.
Maintain protective-intelligence trackers and metrics, including the request log, alert log, case entries, product IDs, and dashboard integrity.
Conduct OSINT collection and analysis for protective-intelligence assessments, documenting sources and findings and contributing analytic judgments to final products.
Draft the weekly intelligence summary, synthesizing alert activity, case developments, and emerging threat trends into concise, decision-ready reporting.
Process intake acknowledgements and maintain records-handling standards for intake channels.
Train to produce the program’s core assessment products to standard and rotate through triage and monitoring coverage.
Serve as designated backup for at least one other product line.
Cross-train teammates in triage and monitoring, maintain current proficiency in teammates’ specialties, and participate in dual-review and after-action practices.
Participate in an on-call rotation for after-hours escalation support as the program matures.
Provide early-morning queue coverage and occasional evening and weekend surge coverage during executive travel windows.
Travel domestically occasionally, at a rate of less than 10%.