Sr. Cyber Threat Intel Technical Analyst

Bank of America•Washington, DC

3d•$145,000 - $192,500•Onsite

About The Position

The Cyber Threat Intelligence Technical Analyst provides deep technical expertise across the platforms, data models, integrations, and automation that enable Bank of America’s Cyber Threat Intelligence organization. This individual-contributor role partners with intelligence teams, security operations, threat hunting, control teams, infrastructure, and enterprise architecture stakeholders to advance CTI technology capabilities. A core focus is advancing Threat Intelligence Platform (TIP) capabilities for repeatable workflows, automation, analyst tasking, indicator lifecycle management, integrations, dashboards, and actionable intelligence delivery. The CTI team works with internal and external partners to reduce risk to the Bank and the financial sector. It provides situational awareness, analyzes threats, and turns threat indicators into actionable information for cyber-security response teams, lines of business, senior leadership, law enforcement, industry peers, and intelligence-sharing partners. The position is based at 1800 K Street NW in Washington, DC. The listed schedule is first shift, 40 hours per week. Bank of America describes an in-office culture, with flexibility based on role responsibilities and business needs. The role is eligible for the annual discretionary incentive plan and benefits, including paid time off and employee support resources.

Requirements

At least 7 years of experience in cybersecurity engineering, cyber threat intelligence, threat intelligence engineering, security automation, or related technical roles.
Strong knowledge of cyber threat intelligence practices, intelligence lifecycle concepts, and their operational application in enterprise security environments.
Hands-on experience configuring, customizing, integrating, or developing Threat Intelligence Platforms, including data models and automated workflows for threat-intelligence objects and processes.
Hands-on experience with APIs, scripting, automation, and systems integration; proficiency in one or more relevant languages such as Python, PowerShell, or JavaScript, or similar.
Experience integrating CTI data with SIEM, SOAR, XDR, detection, threat hunting, and security-control platforms.
Strong understanding of structured threat-intelligence data, common exchange approaches, data normalization, enrichment, tagging, confidence scoring, and indicator lifecycle management.
Deep understanding of enterprise infrastructure domains such as cloud, networking, identity, endpoint, and security operations, and how cyber threats affect them.
Ability to translate complex intelligence and operational requirements into technical designs, automated workflows, and implementable platform capabilities.
Strong troubleshooting and analytical skills across applications, APIs, data pipelines, integrations, and workflow automation.
Strong communication and stakeholder engagement skills, including the ability to influence technical and non-technical audiences and work across security teams.
Ability to serve as a technical subject-matter expert, influence technical decisions, contribute to design and standards development, and share expertise with CTI practitioners and technical partners.
Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field, or equivalent relevant experience.

Nice To Haves

Experience with commercial or open-source TIP technologies and threat-intelligence ecosystems.
Experience with threat-intelligence standards and models such as STIX/TAXII, MITRE ATT&CK, the Diamond Model, or comparable structured intelligence approaches.
Experience with DevSecOps practices, source control, CI/CD, infrastructure or configuration automation, and engineering change governance.
Experience developing operational dashboards, reporting, and performance metrics for intelligence-processing pipelines and automation.
Relevant certifications such as CISSP, GCTI, GIAC, cloud architecture, or comparable cybersecurity or architecture credentials.
Advanced degree in a relevant technical or security discipline.

Responsibilities

Serve as a senior technical subject-matter expert for the CTI organization’s Threat Intelligence Platform, supporting its configuration, customization, development, integrations, automation, and lifecycle management.
Translate analyst needs, intelligence requirements, and workflows into scalable platform capabilities, data models, automation, and technical solutions.
Design, configure, and enhance TIP capabilities for threat-data ingestion, enrichment, normalization, scoring, prioritization, validation, publication, expiration, retention, tasking, and historical context.
Develop and automate indicator-processing and decision workflows, including confidence scoring, contextual enrichment, data-quality criteria, analyst validation, and downstream detection and investigative processes.
Configure and maintain TIP libraries, statuses, task objects, tagging, dashboards, metrics, and workflow logic.
Develop APIs, scripts, connectors, and automation components integrating CTI platforms with SIEM, SOAR, XDR, threat hunting, detection, and other security technologies.
Identify manual processes, workflow bottlenecks, data-quality issues, and automation opportunities, and implement scalable technical solutions.
Collaborate with enterprise architecture, infrastructure, security operations, and risk partners to incorporate threat intelligence into security-engineering decisions and align CTI technology with enterprise security priorities.
Establish and apply engineering practices for TIP configuration, development, integrations, testing, release management, documentation, troubleshooting, root-cause analysis, and ongoing supportability.
Create technical documentation, solution designs, runbooks, and technology roadmaps; share technical knowledge across CTI; and evaluate emerging threats and technology requirements to drive platform improvement.