Threat Intelligence Specialist

• Build and maintain behavior-based detections that identify adversary activity through sequences, relationships, and deviations across identity, endpoint, cloud, network, and application telemetry.
• Translate attacker techniques, malware behaviors, and adversary tradecraft into testable, explainable, and durable detection logic using a detection-as-code approach.
• Define telemetry, enrichment, and normalization requirements needed to improve signal quality, close coverage gaps, and support scalable detection outcomes in a cloud environment.
• Apply statistical methods, machine learning techniques, and Python-based analytical workflows to develop behavioral models, engineering features, and improve precision detection and operational actionability.
• Validate suspicious behaviors using digital forensics and incident response methods to distinguish malicious activity from benign anomalies, misconfigurations, and expected operational patterns.
• Partner with security operations, incident response, and detection engineering teams to operationalize detections with triage guidance, severity rationale, playbook alignment, and MITRE ATT&CK classification and coverage reporting.
• Use external threat intelligence as prioritization context while ensuring detections are grounded in observable behavior and telemetry within the enterprise environment.

Cyber Threat Hunter

Security Analyst

• assess threats to ProMedica’s information technology resources and data
• develop policies, processes and procedures related to a comprehensive security program
• ensure compliance with IT security policies
• review security logs for suspicious activities
• investigate security incidents and upgrades
• perform risk assessments
• available for rotational, on-call 24/7 support

IT Security Analyst II

• Own the day-to-day security operations for a HIPAA-regulated, cloud-only environment
• Harden Microsoft security stack, run incident response, hunt threats, and build the security program
• Investigate alerts, tune detections, close gaps in Conditional Access, ensure compliance posture
• Manage and refine Conditional Access policies, administer Privileged Identity Management (PIM)
• Harden Exchange Online Protection and own email authentication projects
• Write and tune KQL queries in Microsoft Defender Advanced Hunting and triage alerts
• Implement Microsoft Purview information protection labels, DLP policies, and retention rules
• Execute posture improvement roadmaps with external Microsoft security partner

Cybersecurity Analyst

• directly participates in Global Security Operations activities including prevention, detection, and response to IT security incidents worldwide.
• support a wide range of IT security activities including monitoring of alerts, investigation of alerts, incident response, vulnerability response, threat intelligence, and digital forensics.
• assist with the implementation of IT security strategy and serving as a security advisor.
• demonstrate expertise of current enterprise technologies and perform technical risk and vulnerability assessments at the network, system, and application level.
• develop and implement security controls and formulate operational risk mitigations.
• provide guidance and training to less experienced professionals or support staff.
• engage in frequent internal and cross-organizational contact.

Security Analyst III

• Operationalize the Intel Lifecycle: Execute the full intelligence lifecycle to perform fusion analysis, develop adversary profiles focused on financial sector threats, produce finished intelligence products across tactical, operational, and strategic levels.
• Tactical Detection Support: Contextualize threat behavior and anticipate adversary actions, translate analyzed TTPs into technical signatures to directly support the SOC and Detection Engineering teams.
• Intelligence-Driven Threat Hunting: Collaborate with the Threat Hunting team to develop hypotheses based on observed adversary behaviors and regional trends, moving beyond simple Indicator of Compromise (IoC) matching.
• Threat and Vulnerability Context: Support attack surface management team, provide intelligence-driven vulnerability prioritization, identify emerging threats and exploitation trends.
• Adversary Emulation: Provide intelligence support for Red Team or Purple Team exercises by profiling relevant threat actors to ensure testing remains realistic and impactful.
• Strategic & Geopolitical Analysis: Analyze global conflicts and economic stability to translate complex threat activities into structured business solutions and "so-what" summaries for leadership.
• Program Development and Engagement: Contribute to the maturation of the CTI program by developing and refining collection requirements, intelligence workflows, reporting templates, and analytic tradecraft standards.
• Production and Reporting: Produce high-quality tactical, operational, and strategic intelligence products including daily threat briefings, threat actor profiles, vulnerability assessments, and executive threat summaries. Deliver timely and actionable intelligence to internal stakeholders.

Cyber Threat Intelligence Analyst

• Lead geopolitical and supply chain intelligence efforts in support of global operations, travel security, data center security, executive protection, and market expansion initiatives.
• Monitor and assess global events including armed conflict, terrorism, political instability, sanctions, civil unrest, organized crime, regional escalation, and infrastructure disruption, translating developments into actionable business risk assessments.
• Produce strategic, operational, and tactical intelligence products including forecasts, executive briefings, travel risk assessments, crisis updates, heat maps, geospatial overlays, dashboards, and early warning alerts.
• Identify, integrate, and manage intelligence collection pipelines leveraging open-source intelligence (OSINT), commercial intelligence feeds, geospatial data, proprietary sources, and third-party intelligence platforms.
• Design and automate intelligence workflows, alerting mechanisms, and analytical tooling to improve early warning, monitoring, and decision support capabilities.
• Support supply chain resilience efforts by identifying geopolitical, regional, logistical, and infrastructure-related risks that could impact operations, vendors, personnel, or critical dependencies.
• Partner cross-functionally with Global Security, Legal, Supply Chain, Strategy, Infrastructure, and business leadership teams to operationalize intelligence and support risk-informed decision making.
• Conduct post-incident analysis and lessons-learned reviews following geopolitical events, operational disruptions, or security incidents.
• Establish best practices, technical standards, and scalable processes for geopolitical and operational threat intelligence.
• Serve as a subject matter expert on geopolitical risk, strategic warning, and intelligence-driven security operations.
• Maintain relationships with external intelligence vendors, industry peers, academic institutions, and government or law enforcement partners, where appropriate.
• Mentor and guide junior analysts or engineers, share domain knowledge, and contribute to continuous improvement of the team.

Senior Threat Intelligence Specialist – Supply Chain, Geopolitical Security

• Assist in assessing cryptographic posture across applications, platforms, and infrastructure
• Review and analyze data from security tools, inventories and assessments to identify gaps
• Support recurring cryptographic posture assessments and metrics used by security leadership
• Work with structured datasets related to cryptography and encryption controls
• Support analysis and planning activities related to cryptographic transitions

Incident Response Analyst

• Perform penetration testing activities
• Supervise, develop, and coach teams
• Manage client service accounts
• Solve and analyze complex problems
• Deliver elevated-quality deliverables
• Lead and execute stealthy penetration testing

Cyber Incident Response Manager

• Developing and maintaining Threat Models
• Analyzing Threat Intelligence Data
• Mapping Threats to the Kill Chain and MITRE ATT&CK Framework
• Communicating Findings
• Collaborating with Security Teams
• Contributing to Threat Hunting Efforts
• Staying Current with the Threat Landscape
• Automating and Improving Modeling Processes

• Execute Guardian’s cyber incident response strategy, acting swiftly to identify, contain, and eradicate security incidents
• Conduct thorough investigations of security events and coordinate recovery efforts with other teams to restore normal operations
• Create detailed reports on incident response activities, findings, and recommendations, and maintain accurate records of investigations and outcomes
• Respond to data loss prevention events to prevent unauthorized access and exfiltration of sensitive data
• Proactively search for cyber threats within the network using advanced techniques; identify patterns, anomalies, and potential indicators of compromise
• Perform forensic analysis on compromised systems and collect evidence in accordance with legal and regulatory requirements
• Stay informed on current and emerging cyber threats that may impact the organization
• Perform regular threat hunts to contribute to our proactive defense program
• Identify use cases for detection engineering to strengthen Guardian’s security posture
• Collaborate across multiple teams and business units.
• Strategically use AI-powered solutions to improve detection, investigation efficiency, and overall cyber resilience.
• Provide Tier 2 support for the Cyber Defense Operations Team, working closely to identify and respond to potential threats

Cyber Incident Responder, Threat Hunter

• Lead a team of cyber security incident response and threat mitigation engineering professionals
• Be responsible for planning, design, operating Guardian’s cyber incident response and cyber threat mitigations operations across the areas
• Run our Corporate Incident Response Team as related to cybersecurity – coordinating actions and responses across teams
• Manage the plans, playbooks, quick reference guides necessary – and out-of-band communication plans
• Engage with 1st line teams to develop muscle memory and ensure containment actions (shutdown authorities are clear)
• Coordinate with business continuity/disaster recovery teams to ensure integrated approach to large events
• Be responsible for triaging & leading cyber security incidents advanced from the security operations center
• Manage third-party incident retainers and prepare for any future engagements
• Participate-in / coordinate periodic exercises with third-parties
• Ensure quality of security incident handling and cyber threat mitigation work
• Ensure incidents are appropriately tracked, reported and after-action reports documented
• Ensure metrics are timely and accurate
• Drive our user behavior analytics (UBA) program working with the business to develop and improve appropriate logging monitoring
• Develop standard operating procedures for our 1st line SOC based on threats/observed incidents
• Proactively identify gaps and opportunities in our logging and monitoring processes
• Host monthly incident response calibration/collaboration meetings across HR, physical security, fraud, legal, compliance to collaborate on issues and shared threats and knowledge
• Communicate to various levels of the organization, both written and oral concisely and clearly
• Provide strong technical understanding of security control monitoring process at different layers
• Identify (and champion where applicable) risk mitigation
• Collaborate with other leaders across cybersecurity to help define and complete cybersecurity strategy, financial, vendor and talent management
• Contribute to the enterprise organizational Data Loss Prevention program
• Lead, manage, guide, and mentor the staff on a regular basis, including selection/retention, goal setting, annual reviews, and compensation planning and career development
• Provide recommendations to management & leadership team to increase effectiveness of security technology solutions to mitigate cyber threats and handle incidents
• Respond to and assist with due diligence and internal / external security audit requests
• Identify and act on opportunities to further enhance and refine security incident handling & cyber threat mitigation processes & capabilities.

Head of Cyber Incident Response, Cyber Threat Mitigation Services

• Ensure compliance with DoD and VA cybersecurity requirements (e.g., RMF, NIST 800-53, FedRAMP where applicable)
• Support Authority to Operate (ATO) processes, including documentation, control implementation, and continuous monitoring
• Collaborate with product, engineering, IT, and compliance teams to integrate security controls into systems and services
• Conduct risk assessments, control testing, and gap analyses aligned with NIST, HIPAA, and other regulatory frameworks
• Maintain and update security policies, standards, and procedures to meet federal and enterprise requirements
• Assist in audit readiness and support internal/external audits (DoD, VA, HIPAA, as applicable)
• Monitor regulatory changes and assess impact on QuidelOrtho products and services
• Support third-party/vendor risk management, especially for federal-facing solutions
• Contribute to incident response, vulnerability management, and remediation tracking from a compliance perspective
• Provide security awareness and guidance to cross-functional teams on federal compliance expectations
• Perform other work-related duties as assigned.

Information Security Analyst

• Maintain ownership of assigned customer accounts, facilitate high levels of customer satisfaction, and be a trusted advisor for CAO Elite customers
• Perform threat hunting, research dark web data, and research tailored threat intelligence for CAO Elite customers based on their specific requirements and environment
• Prepare and deliver customer presentations relating to intelligence reports, dark web alerts, and threat hunting findings on a regular basis
• Respond to customer requests relating to threat intelligence, threat hunting, and dark web monitoring

Senior Threat Hunting Intelligence Analyst

• Lead the planning, coordination, scheduling, and execution of tabletop exercises focused on emerging threats and resiliency capabilities.
• Partner closely with application, infrastructure, identity, cloud, backup, and security teams to coordinate participants and timelines.
• Design and facilitate threat‑informed tabletops, execute hands‑on recovery scenarios, validate recovery runbooks through execution, and assess key technical resiliency capabilities.
• Ensure that risks to all information assets are being managed in a timely and effective manner to meet the Information Security Program requirements and current threat landscape.
• Provide vision, direction, and expertise to more experienced leadership on implementing innovative and significant business solutions that are large-scale, cross-functional, or companywide strategies.
• Ensure the team has the necessary training and is keeping abreast of regulatory and compliance issues.
• Engage with all levels of professionals and managers companywide and serve as an experienced advisor to leadership.

Senior Lead Information Security Analyst

• Analyze complex cybersecurity problems to manage workstreams and develop deliverables
• Guide and mentor junior team members
• Build and sustain meaningful client relationships to drive engagement
• Work with team members to enhance operational effectiveness
• Uphold the firm's ethical standards and compliance requirements
• Analyze data to inform decision-making and improve outcomes

Senior Associate, Cyber Defense – Cyber Incident Response

• Lead and support advanced SOC investigations, incident response activities, and Tier-3 escalations, providing deep technical analysis of security alerts, anomalous behavior, and suspected malicious activity
• Perform proactive threat hunting activities across enterprise security telemetry including SIEM, EDR, identity, network, and cloud logs to identify previously undetected or emerging threats
• Analyze attacker behaviors and intrusion patterns to develop threat hunting hypotheses and detection strategies aligned with the MITRE ATT&CK framework
• Investigate complex security alerts and incidents, performing log analysis, endpoint analysis, and timeline reconstruction to determine root cause, scope, and impact
• Leverage internal telemetry, alerts, and IOC trends to identify threat patterns targeting the organization and opportunities for improved detection coverage
• Enhance threat detection and response capabilities by supporting the development and improvement of SOC detection logic, response procedures, escalation playbooks, and analyst decision trees
• Conduct proactive analysis of alert trends to identify gaps in detection coverage and recommend new or improved monitoring capabilities
• Utilize Cyber Threat Intelligence (CTI) sources to contextualize incidents, inform threat hunting efforts, and prioritize investigations
• Monitor open-source, closed-source, and vendor-provided threat intelligence to stay abreast of emerging threats, vulnerabilities, and adversary tactics relevant to the organization
• Develop and maintain profiles of relevant threat actors, including tactics, techniques, and procedures (TTPs), and incorporate those insights into threat hunting and detection strategies
• Assist in SOC and Incident Response escalations, providing technical expertise and investigative support during security incidents
• Conduct threat, risk, and vulnerability assessments to provide actionable remediation and security control improvement guidance
• Collaborate with the Red Team and Cyber Incident Management to support red team exercises, incident response training, tabletop exercises, and detection validation
• Perform targeted access reviews and anomaly analysis across enterprise systems (Windows, Linux, databases, network infrastructure, cloud platforms) to identify suspicious activity
• Collaborate with DLP and other security teams on insider risk investigations and monitoring initiatives
• Contribute to the development and improvement of SOC procedures, threat hunting methodologies, and intelligence-driven detection processes
• Collaborate with relevant stakeholders on security awareness messaging and threat awareness related communications

See all jobs on JobTailor

Cyber Threat Hunter

IT Security Analyst II

Cybersecurity Analyst

Security Analyst III

Cyber Threat Intelligence Analyst

Senior Threat Intelligence Specialist – Supply Chain, Geopolitical Security

Security Analyst

Cyber Incident Response Manager

Cyber Threat Intelligence Analyst

Cyber Incident Responder, Threat Hunter

Head of Cyber Incident Response, Cyber Threat Mitigation Services

Information Security Analyst

Senior Threat Hunting Intelligence Analyst

Senior Lead Information Security Analyst

Senior Associate, Cyber Defense – Cyber Incident Response

Senior Cyber Threat Analyst