Limitless potential.

SUMMARY: The Cyber Threat Intelligence Engineer Lead provides technical leadership for the collection, analysis, enrichment, and operationalization of CTI to identify and mitigate threats to the organization. This role performs complex analysis of cyber threat actors, campaigns, tactics, techniques, and procedures (TTPs), vulnerabilities, malware, and emerging threats and translates intelligence into actionable defensive measures. This person leads increasingly complex day-to-day Cyber Threat Intelligence activities, partners closely with Security Operations on Incident Response, Threat Hunting, Security Monitoring, Exposure Management, and other related functions, providing intelligence-driven recommendations to strengthen the organization’s security posture.

You must be eligible to work in the US without Visa Sponsorship

JOB DUTIES

• Leads complex cyber threat intelligence analysis across multiple security domains, business functions, technologies, and threat environments.
• Collects, analyzes, evaluates, and correlates threat intelligence from internal telemetry, commercial intelligence providers, open-source intelligence, government sources, industry information-sharing organizations, and other trusted sources.
• Researches and tracks threat actors, malware, campaigns, vulnerabilities, exploits, infrastructure, tactics, techniques, and procedures (TTPs) relevant to the organization and its technology environment.
• Develops intelligence products including tactical alerts, threat assessments, intelligence reports, threat actor profiles, vulnerability intelligence, campaign analysis, executive briefings, and strategic threat assessments.
• Maps adversary behaviors and observed activity to industry frameworks such as MITRE ATT&CK and uses intelligence to support detection engineering, threat hunting, incident response, and security control improvements.
• Operationalizes threat intelligence by developing, enriching, and maintaining indicators, detection opportunities, intelligence requirements, watchlists, threat models, and other intelligence artifacts used by Security Operations teams.
• Partners with Security Operations and Detection Engineering teammates to translate threat intelligence into SIEM, EDR, NDR, and other security analytics, detections, and hunting hypotheses.
• Supports proactive threat hunting by developing intelligence-driven hypotheses and identifying adversary behaviors, indicators, and attack patterns that warrant investigation within the environment.
• Provides threat intelligence support during cybersecurity incidents, including adversary research, infrastructure analysis, indicator enrichment, campaign correlation, and assessment of potential scope and impact.
• Analyzes vulnerability and exploit intelligence to help prioritize vulnerabilities and exposures based on observed exploitation, adversary activity, threat relevance, asset exposure, and potential business impact.
• Develops and maintains automation, integrations, scripts, APIs, and workflows to improve threat intelligence collection, enrichment, correlation, dissemination, and operationalization across security platforms.
• Establishes and maintains intelligence requirements and collection priorities aligned with organizational risks, critical assets, business operations, and the evolving external threat landscape.
• Evaluates the effectiveness and relevance of intelligence sources, threat feeds, platforms, tooling, and processes and recommends improvements that increase intelligence quality and defensive value.
• Provides technical leadership, guidance, and mentoring to Cyber Threat Intelligence engineers and analysts and promotes consistent intelligence tradecraft, documentation, analytical standards, and operational practices.
• Communicates complex technical threat information to technical and non-technical stakeholders and provides clear recommendations for mitigating identified risks.
• Identifies opportunities to improve Cyber Threat Intelligence processes, automation, integrations, reporting, metrics, and intelligence-driven security operations.
• Performs other related duties as assigned

EDUCATION & EXPERIENCE

Typically requires a bachelor’s degree in cybersecurity, computer science, information technology, intelligence studies, or a related field and 8-12 years of related cybersecurity experience, including significant experience in cyber threat intelligence, threat hunting, incident response, detection engineering, security operations, or equivalent experience.

KNOWLEDGE, SKILLS, ABILITIES

• Demonstrates advanced knowledge of cyber threat intelligence methodologies, intelligence lifecycle concepts, intelligence collection, structured analysis, threat actor tracking, and intelligence dissemination.

• Possesses advanced knowledge of adversary tactics, techniques, and procedures, attack lifecycles, threat actor behaviors, malware, vulnerabilities, exploits, and emerging cyber threats.

• Demonstrates strong knowledge of the MITRE ATT&CK framework and its application to threat intelligence, detection engineering, threat hunting, and defensive security operations.

• Possesses experience with threat intelligence platforms, SIEM, EDR, NDR, SOAR, vulnerability management platforms, and commercial and open-source threat intelligence sources.

• Understands threat intelligence standards and technologies such as STIX/TAXII, APIs, indicator enrichment, threat intelligence sharing, and automated intelligence workflows.

• Possesses scripting, query, or programming skills using technologies such as Python, PowerShell, KQL, SQL, regular expressions, or similar languages used for security analysis and automation.

• Demonstrates strong investigative and analytical skills with the ability to correlate large volumes of security, intelligence, vulnerability, and telemetry data to identify meaningful threat activity and trends.

• Communicates complex cyber threats, technical findings, risk implications, and recommended actions clearly to technical teams, business stakeholders, and senior leadership.

• Manages multiple intelligence requirements, investigations, and priorities simultaneously while meeting operational deadlines.

• Demonstrates technical leadership and the ability to mentor engineers and analysts, establish standards, and coordinate intelligence activities across Cyber Defense functions.

• Maintains current knowledge of the evolving cyber threat landscape, adversary tradecraft, security technologies, vulnerabilities, exploits, and defensive techniques.

• Pays close attention to detail, demonstrates sound analytical judgment, and has a strong desire to investigate beyond initial indicators to understand adversary intent, capabilities, infrastructure, and potential organizational impact.

• Relevant industry certifications such as GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Incident Handler (GCIH), GIAC Network Forensic Analyst (GNFA), Certified Information Systems Security Professional (CISSP), or equivalent certifications are preferred.

Not the right fit?  Let us know you're interested in a future opportunity by joining our Talent Community onjobs.genpt.comor create an account to set up email alerts as new job postings become available that meet your interest!

GPC conducts its business without regard to sex, race, creed, color, religion, marital status, national origin, citizenship status, age, pregnancy, sexual orientation, gender identity or expression, genetic information, disability, military status, status as a veteran, or any other protected characteristic. GPC's policy is to recruit, hire, train, promote, assign, transfer and terminate employees based on their own ability, achievement, experience and conduct and other legitimate business reasons.