Threat Intelligence Analyst

Blackthorne Consulting

About The Position

Threat Intelligence Analysts / Engineers collect data, research threats, analyze information, and create actionable insights to improve enterprise detection, response, and risk awareness. The role combines technical capabilities such as scripting, sandboxing, and automation with threat analysis and operational security engineering. Analysts identify collection opportunities, track adversary activity, investigate campaigns, and build scripts and tooling to scale their work. They collaborate with Blackthorne’s detection engineering, threat hunt, and adversary emulation teams so intelligence directly strengthens defensive capabilities. Blackthorne is a mission-focused consulting organization seeking professionals who bring technical expertise, accountability, collaboration, and a commitment to measurable client outcomes. Analysts produce threat actor profiles and campaign analyses, intelligence automation pipelines, client threat briefings, and assessments of client threat intelligence capabilities. Success is measured by improvements in detection coverage, faster incident response, and adoption of actionable intelligence by clients.

Requirements

At least 4 years of experience in threat intelligence.
At least 2 years of experience writing analysis scripts or other applicable automation.
At least 2 years of experience with sandboxes and sandboxing technology.
At least 2 years of experience tracking criminal threat actors.
Experience analyzing adversary tactics and campaigns.
Familiarity with enterprise attack techniques.
Experience producing technical intelligence reports.
Ability to translate threat intelligence insights into actionable threat detection, threat hunting, or other control recommendations.

Nice To Haves

At least 2 years of experience working as a threat intelligence analyst in a professional organization.
A demonstrated track record of open source contributions or conference talks related to automated analysis of threat data, sandboxing, or related topics.
Malware analysis experience, including writing and maintaining YARA signatures.
Experience tracking nation-state actors.
Experience with threat intelligence platforms such as MISP or OpenCTI.
Python or other scripting experience.

Responsibilities

Track adversary groups and campaigns relevant to enterprise environments.
Identify and exploit data collection opportunities.
Analyze emerging threat techniques, malware families, and attack infrastructure.
Build automation to scale analysis.
Conduct in-depth, high-interaction analysis of phishing campaigns, command-and-control infrastructure, and attacker tooling.
Develop automation pipelines to collect, normalize, and enrich threat intelligence data.
Maintain internal intelligence repositories and campaign tracking systems.
Build and maintain basic APIs to integrate with enterprise security platforms where possible.
Evaluate threat intelligence feeds and data sources for timeliness, reliability, and relevancy.
Produce threat intelligence reports and campaign analyses.
Deliver technical briefings to security teams and executive stakeholders.
Support incident investigations with adversary context and attribution insights.
Assess existing or desired client threat intelligence functions and develop actionable requirements and roadmaps to improve client maturity.
Provide actionable intelligence inputs to detection engineering, threat hunting, and adversary emulation teams.