Threat Intelligence Analyst — Autonomous Response

What the role is responsible for.

• Assess adversary capability and intent against defended infrastructure, and maintain the standing threat model.
• Write analytic product to a house standard that carries sourcing and confidence explicitly.
• Work with platform engineers to translate assessed threat into detection and response logic.
• Run structured analytic techniques against your own conclusions before they ship.
• Contribute to post-incident review and correct the model when it was wrong.

What we need you to bring.

• Six or more years in threat intelligence, all-source analysis, or an equivalent assessed-product discipline.
• Demonstrated analytic writing under a sourcing and confidence standard.
• Technical literacy sufficient to argue with detection engineers on the merits.
• Familiarity with structured analytic techniques and the discipline to actually apply them.
• Active or eligible TS · SCI; vetting is sponsored.

Useful, not essential.

• Background in critical infrastructure or industrial control system threat.
• Experience supporting an automated or semi-automated decision system.
• Language capability relevant to a priority region.

We read the preferred list as a description of a useful background, not a checklist. Candidates who meet the required list and none of the preferred are regularly hired.

Who you would be joining.

Threat Analysis sits inside Defense & Security alongside platform engineering, deliberately co-located so that assessment and implementation argue in the same room.

What to know before you apply.

Secure remote work is available for a limited portion of the week once access is established. Some role detail is disclosed only after clearance.

All candidates undergo comprehensive vetting. Reasonable accommodation is available at any stage — say so in your first note and it will be arranged. We do not use unverified third-party recruiters, and we never ask a candidate for a fee.