Forensics and Integrity Services-Crisis and Investigations-Cyber Threat Intelligence-Senior Manager

EY•Atlanta, DC

6d•$113,800 - $295,400

About The Position

EY’s Forensic & Integrity Services practice advises corporate and government clients on complex matters involving crisis management, fact-based and digital investigations, insider threat services, crisis and incident preparedness, and threat intelligence. The Senior Manager, Cyber Threat Intelligence will help grow and operate the Crisis & Investigations Managed Services solution by leading a scalable threat intelligence capability supporting cyber breach, forensic investigation, and remediation matters. The role directs multidisciplinary teams and establishes repeatable intelligence requirements, analytical workflows, quality standards, products, and reporting across multiple client matters. It works with forensic and incident-response professionals, client executives, legal counsel, security teams, and other stakeholders to turn threat information into timely, practical, actionable insights. The position also supports breach readiness, retainers, exercises, proposals, market activity, and thought leadership.

Requirements

Bachelor’s degree in Cybersecurity, Intelligence Studies, Criminal Justice, Computer Science, Information Systems, International Relations, Security Studies, or a related field.
Significant experience in cyber threat intelligence, intelligence analysis, cyber investigations, law enforcement, national security, cyber incident response, or a closely related field.
Demonstrated understanding of cybercriminal actors, threat activity, and tactics, techniques and procedures.
Experience supporting complex investigations, cyber incidents, or other time-sensitive threat matters.
Experience designing or operating repeatable analytical workflows, intelligence products, quality standards, or reporting processes.
Experience leading teams and managing delivery expectations, analytical quality, service performance, and risk.
At least 8 years of significant, related work experience.
Strong negotiation and influencing skills, with the confidence to communicate complex concepts to a wide range of audiences.
At least one relevant professional designation or certification, or commitment to obtain an approved certification within the first year of employment.
Ability and willingness to travel and work in excess of standard hours when necessary.
Access to reliable transportation to and from the EY office and client sites; a driver’s license is strongly recommended because ride-share and public transportation options may not be available in all locations.
Ability to manage a portfolio of cyber threat intelligence services, including strategy, analytical operations, quality, delivery, and continuous improvement.
Ability to apply managed services principles, including operational responsibility, repeatable delivery, service performance, scalable operating models, and knowledge management.
Deep knowledge of cyber threat intelligence, cybercriminal activity, intelligence-analysis principles, and relevant tactics, techniques and procedures.
Ability to connect threat intelligence with forensic and incident-response activities without overstating what available intelligence or evidence establishes.
Ability to evaluate incomplete, evolving, and conflicting information and distinguish facts, assumptions, judgments, and confidence levels.
Ability to translate complex intelligence into meaningful, decision-useful insights for executives and non-technical audiences.
Ability to develop configurable intelligence products and institutionalize effective practices rather than depend on individual knowledge or informal relationships.
Ability to develop team members through ongoing coaching, feedback, and challenging assignments.

Nice To Haves

Master’s degree.
Relevant cyber threat intelligence, cyber investigations, incident response, or national security leadership experience at the senior level.
Experience with service transition, service mobilization, service performance management, knowledge management, or continuous improvement.
Experience collaborating with federal law enforcement, intelligence-community organizations, or other government cyber organizations.
Experience using threat-intelligence platforms, structured analytical workflows, reporting technology, or knowledge repositories to support scalable delivery.

Responsibilities

Lead the strategy, delivery, quality, and continuous improvement of the cyber threat intelligence service across breach investigations and incident-response engagements.
Establish repeatable processes for intelligence requirements, collection, source evaluation, analysis, quality review, dissemination, feedback, and knowledge retention.
Identify and assess intelligence relevant to cybercriminal threat actors, behaviors, tactics, techniques and procedures, infrastructure, and evolving threat activity.
Work with forensic and incident-response professionals to define intelligence requirements and inform investigative priorities, containment considerations, and remediation planning.
Translate findings into actionable insights for engagement teams, client executives, legal professionals, and technical stakeholders.
Develop standardized and configurable threat assessments, intelligence notes, executive briefings, and reporting packages.
Maintain analytical standards that distinguish facts, assumptions, intelligence judgments, and confidence levels, while preserving the distinction between intelligence assessments and forensic conclusions.
Coordinate concurrent intelligence requirements across client matters and monitor service performance, responsiveness, quality, and risk.
Use data, AI, threat intelligence technology, structured workflows, and knowledge repositories appropriately to improve efficiency and scalability.
Capture lessons learned, threat patterns, and reusable knowledge while respecting confidentiality and information-sharing restrictions.
Build productive relationships across cybersecurity, law-enforcement, government, and private-sector communities to support responsible information exchange.
Support breach readiness, retainers, exercises, proposals, market activity, and thought leadership.
Lead, coach, and develop intelligence professionals and supporting team members.