Threat Intel Lead

Nightwing Intelligence Solutions•Sterling, VA

About The Position

Nightwing is seeking a Senior Manager to lead a four-person Watch and Warning Analysis Team supporting a U.S. Government customer. The team provides cybersecurity vulnerability analysis intended to reduce the prevalence and impact of vulnerabilities and exploitable conditions across Federal Civilian Executive Branch entities and Critical Infrastructure Key Resources. It uses cyber threat intelligence and strong analytical skills to assess information from multiple sources and provide expert analysis to senior customer stakeholders. The lead translates executive directives and policy into analytic priorities and collection requirements, oversees the quality of intelligence products, and coordinates cross-functional projects. The role reviews vulnerability reporting, evaluates exposure and risk to federal agencies and critical infrastructure, coordinates mitigation efforts, and communicates findings to both technical practitioners and Senior Executive Service leadership. The lead also develops operational summaries and adversary assessments from open-source, commercial, and classified reporting, monitors emerging threats and technologies, and serves as the technical subject matter expert for the Federal Staff.

Requirements

Must be a U.S. citizen.
Must have an active TS/SCI clearance.
Must be able to obtain DHS Suitability.
Ability to work with minimal supervision, establish priorities and delivery schedules amid uncertain timelines, and set quality assurance criteria for project deliverables.
At least four years of experience producing analytic products such as reports, briefings, or dashboards based on real-world threats, incidents, or vulnerabilities.
Experience assessing adversary campaigns, capabilities, motivations, and tactics, techniques, and procedures to produce operational and strategic intelligence products.
Experience evaluating vulnerabilities, exposure, exploitability, and evidence of adversary use, and assessing potential consequences for federal agencies and critical infrastructure.
Experience correlating indicators of compromise, technical reports, and open-source, commercial, and classified reporting to develop supported adversary assessments.
Experience utilizing attack surface management tools or assessments from red teams.
Demonstrated team leadership experience, including mentoring and teaching new analysts and developing training pipelines.
Experience directing cyber threat intelligence research into reports, presentations, and assessments for a variety of technology stacks.
Experience developing and delivering technical briefings to cyber practitioners and Senior Executive Service leadership.
Knowledge of system and application security threats and vulnerabilities, including how to mitigate them.
Bachelor of Science in Computer Science, Computer Engineering, Computer Information Systems, Cybersecurity, or a related degree; alternatively, 10+ years of cyber incident management or cybersecurity experience with a high school diploma.

Nice To Haves

Previous work with OT/ICS/SCADA technologies, particularly their vulnerabilities and historic adversary threats.
Experience in any capacity with critical infrastructure.
Experience with ransomware actors, including interactions with or monitoring of access brokers, dark web forums, or negotiations.
Experience with emerging threats, including space systems, AI, and quantum computing.
Ability to clean, normalize, enrich, and analyze large datasets with inconsistent formats and schemas, and identify and support intelligence assessments from those datasets.
Experience with administrative applications such as SharePoint, ServiceNow, or Microsoft Teams Automation.
Experience with commercial threat intelligence tools such as Shodan, Censys, GTI, or CrowdStrike.
Experience with large data analytics and analysis applications such as DataBricks or Power BI.
Experience with threat intelligence platforms such as Analyst1 or OpenCTI.
Experience with attack surface management tools such as BitSight or Cortex Expanse.
Desired certifications: CISM, CISSP, GCTI, GCED, GOSI, CTIA, or CySA+.

Responsibilities

Lead a four-person cyber threat intelligence team analyzing emerging vulnerabilities and adversary campaigns, and coordinate response efforts with government and industry partners.
Translate executive directives and policy into analytic priorities and intelligence collection requirements for analysts.
Oversee quality assurance for analyst intelligence products and presentations.
Prioritize and coordinate cross-functional analytic projects, integrating technical data and enriched indicators of compromise into comprehensive adversary assessments that guide cyber defenders.
Review daily vulnerability reporting to assess risk and potential impacts to critical infrastructure and Federal Civilian Executive Branch entities.
Communicate findings to technical practitioners and Senior Executive Service leadership.
Use attack surface management tools to assess vulnerability prevalence across federal agencies; develop mitigation plans and coordinate with threat hunting teams to reduce adversary exploitation risk.
Author and present weekly operational summaries, consolidate intelligence reports, and prepare adversary campaign assessments using open-source, commercial, and classified reporting.
Monitor emerging threats and disruptive technologies in open-source and classified reporting; identify findings and present actionable recommendations.
Serve as the technical subject matter expert for the Federal Staff and ensure government ideas are properly presented to external stakeholders and industry subject matter experts.