Senior Threat Intelligence Analyst

JLL•Atlanta, GA

1d•$170,000 - $230,000•Remote

About The Position

This individual-contributor role sits on JLL's Threat Intelligence Program, working across the full intelligence cycle in close partnership with Cyber Defense, engineering, and business leaders. The role requires ownership: you will take problems from ambiguous starting point to briefed conclusion, and you'll be trusted and expected to operate that way. It demands both technical depth and strategic sense, and the judgment to know which the moment calls for. We view threat intelligence as, at its core, rigorous analytic tradecraft, the discipline of reasoning under uncertainty, quickly and always in service of a stakeholder. We are an actionable support system, and our job is to drive the efficient allocation of resources against the threats that are relevant and timely to JLL. That demands the full range of analytic discipline, source vetting, calibrated confidence, and clear reasoning among them so that what we hand a stakeholder is a defensible assessment, not a repeated claim.

Requirements

5+ years in cybersecurity, with at least 3 in a dedicated threat intelligence role.
Meaningful experience working in, on, or alongside operational security teams such as threat hunt, SOC/IR, or detection engineering, either supporting them in an intelligence capacity or handling and applying intelligence directly while serving in one of those roles.
A demonstrated ability to bring structure to ambiguous problems and drive them to a customer-focused resolution.
A working command of AI in an analytic context: its strengths, its failure modes, and how to codify analyst judgment and discipline into repeatable tooling and workflows.
An understanding of the adversary ecosystem, how different threat groups are structured and how they interplay, and of adversary tradecraft: how campaigns are executed, and where along the attack chain defenders have opportunities to act.
Grounding in intelligence discipline: how to gauge source fidelity, how to determine relevance and actionability, what timeliness means, and how to ingest and interpret intel reporting from different vendors and sources.
Excellent briefing skills, in person and virtual, tailored to audiences of varying technical depth.
Working knowledge of EDR, SIEM, TIP, IPS, and WAF, with experience building intelligence automation into tooling.
Familiarity with frameworks such as NIST 800-53, ISO 27001, MITRE ATT&CK, and CIS.

Responsibilities

Operate across all phases of the intelligence cycle, from requirements through dissemination, exercising sound judgment on scope and priority as new threats emerge.
Take loosely scoped questions and add the bounds yourself, frame the problem, define what "answered" looks like, and drive it to a conclusion that serves a real stakeholder, not just closes the request.
Produce intelligence calibrated to its audience, from engineers to executives, with a clear read on who the customer is and what decision they need to make.
Partner with Cyber Defense and engineering as a technical peer to translate intelligence into mitigation and detection strategies.
Help guide our intel-architecture requirements, working with engineers to shape the tooling, automation, and data flows that support the team, without needing to be the engineer yourself.
Help shape and evolve our Priority Intelligence Requirements and Collection Requirements as the threat landscape shifts.
Prepare and deliver briefings, after-action reports, and program metrics to technical and executive audiences.