Threat Intelligence Specialist

• Build and maintain behavior-based detections that identify adversary activity through sequences, relationships, and deviations across identity, endpoint, cloud, network, and application telemetry.
• Translate attacker techniques, malware behaviors, and adversary tradecraft into testable, explainable, and durable detection logic using a detection-as-code approach.
• Define telemetry, enrichment, and normalization requirements needed to improve signal quality, close coverage gaps, and support scalable detection outcomes in a cloud environment.
• Apply statistical methods, machine learning techniques, and Python-based analytical workflows to develop behavioral models, engineering features, and improve precision detection and operational actionability.
• Validate suspicious behaviors using digital forensics and incident response methods to distinguish malicious activity from benign anomalies, misconfigurations, and expected operational patterns.
• Partner with security operations, incident response, and detection engineering teams to operationalize detections with triage guidance, severity rationale, playbook alignment, and MITRE ATT&CK classification and coverage reporting.
• Use external threat intelligence as prioritization context while ensuring detections are grounded in observable behavior and telemetry within the enterprise environment.

Cyber Threat Hunter

• Lead geopolitical and supply chain intelligence efforts in support of global operations, travel security, data center security, executive protection, and market expansion initiatives.
• Monitor and assess global events including armed conflict, terrorism, political instability, sanctions, civil unrest, organized crime, regional escalation, and infrastructure disruption, translating developments into actionable business risk assessments.
• Produce strategic, operational, and tactical intelligence products including forecasts, executive briefings, travel risk assessments, crisis updates, heat maps, geospatial overlays, dashboards, and early warning alerts.
• Identify, integrate, and manage intelligence collection pipelines leveraging open-source intelligence (OSINT), commercial intelligence feeds, geospatial data, proprietary sources, and third-party intelligence platforms.
• Design and automate intelligence workflows, alerting mechanisms, and analytical tooling to improve early warning, monitoring, and decision support capabilities.
• Support supply chain resilience efforts by identifying geopolitical, regional, logistical, and infrastructure-related risks that could impact operations, vendors, personnel, or critical dependencies.
• Partner cross-functionally with Global Security, Legal, Supply Chain, Strategy, Infrastructure, and business leadership teams to operationalize intelligence and support risk-informed decision making.
• Conduct post-incident analysis and lessons-learned reviews following geopolitical events, operational disruptions, or security incidents.
• Establish best practices, technical standards, and scalable processes for geopolitical and operational threat intelligence.
• Serve as a subject matter expert on geopolitical risk, strategic warning, and intelligence-driven security operations.
• Maintain relationships with external intelligence vendors, industry peers, academic institutions, and government or law enforcement partners, where appropriate.
• Mentor and guide junior analysts or engineers, share domain knowledge, and contribute to continuous improvement of the team.

Senior Threat Intelligence Specialist – Supply Chain, Geopolitical Security

• Execute Guardian’s cyber incident response strategy, acting swiftly to identify, contain, and eradicate security incidents
• Conduct thorough investigations of security events and coordinate recovery efforts with other teams to restore normal operations
• Create detailed reports on incident response activities, findings, and recommendations, and maintain accurate records of investigations and outcomes
• Respond to data loss prevention events to prevent unauthorized access and exfiltration of sensitive data
• Proactively search for cyber threats within the network using advanced techniques; identify patterns, anomalies, and potential indicators of compromise
• Perform forensic analysis on compromised systems and collect evidence in accordance with legal and regulatory requirements
• Stay informed on current and emerging cyber threats that may impact the organization
• Perform regular threat hunts to contribute to our proactive defense program
• Identify use cases for detection engineering to strengthen Guardian’s security posture
• Collaborate across multiple teams and business units.
• Strategically use AI-powered solutions to improve detection, investigation efficiency, and overall cyber resilience.
• Provide Tier 2 support for the Cyber Defense Operations Team, working closely to identify and respond to potential threats

Cyber Incident Responder, Threat Hunter

• Maintain ownership of assigned customer accounts, facilitate high levels of customer satisfaction, and be a trusted advisor for CAO Elite customers
• Perform threat hunting, research dark web data, and research tailored threat intelligence for CAO Elite customers based on their specific requirements and environment
• Prepare and deliver customer presentations relating to intelligence reports, dark web alerts, and threat hunting findings on a regular basis
• Respond to customer requests relating to threat intelligence, threat hunting, and dark web monitoring

Senior Threat Hunting Intelligence Analyst

• Lead and support advanced SOC investigations, incident response activities, and Tier-3 escalations, providing deep technical analysis of security alerts, anomalous behavior, and suspected malicious activity
• Perform proactive threat hunting activities across enterprise security telemetry including SIEM, EDR, identity, network, and cloud logs to identify previously undetected or emerging threats
• Analyze attacker behaviors and intrusion patterns to develop threat hunting hypotheses and detection strategies aligned with the MITRE ATT&CK framework
• Investigate complex security alerts and incidents, performing log analysis, endpoint analysis, and timeline reconstruction to determine root cause, scope, and impact
• Leverage internal telemetry, alerts, and IOC trends to identify threat patterns targeting the organization and opportunities for improved detection coverage
• Enhance threat detection and response capabilities by supporting the development and improvement of SOC detection logic, response procedures, escalation playbooks, and analyst decision trees
• Conduct proactive analysis of alert trends to identify gaps in detection coverage and recommend new or improved monitoring capabilities
• Utilize Cyber Threat Intelligence (CTI) sources to contextualize incidents, inform threat hunting efforts, and prioritize investigations
• Monitor open-source, closed-source, and vendor-provided threat intelligence to stay abreast of emerging threats, vulnerabilities, and adversary tactics relevant to the organization
• Develop and maintain profiles of relevant threat actors, including tactics, techniques, and procedures (TTPs), and incorporate those insights into threat hunting and detection strategies
• Assist in SOC and Incident Response escalations, providing technical expertise and investigative support during security incidents
• Conduct threat, risk, and vulnerability assessments to provide actionable remediation and security control improvement guidance
• Collaborate with the Red Team and Cyber Incident Management to support red team exercises, incident response training, tabletop exercises, and detection validation
• Perform targeted access reviews and anomaly analysis across enterprise systems (Windows, Linux, databases, network infrastructure, cloud platforms) to identify suspicious activity
• Collaborate with DLP and other security teams on insider risk investigations and monitoring initiatives
• Contribute to the development and improvement of SOC procedures, threat hunting methodologies, and intelligence-driven detection processes
• Collaborate with relevant stakeholders on security awareness messaging and threat awareness related communications

See all jobs on JobTailor

Cyber Threat Hunter

Senior Threat Intelligence Specialist – Supply Chain, Geopolitical Security

Cyber Incident Responder, Threat Hunter

Senior Threat Hunting Intelligence Analyst

Senior Cyber Threat Analyst