Cyber Threat Intelligence Analyst Jobs
Cyber Threat Intelligence Analyst jobs are open across defense, financial services, healthcare, and technology, from junior analyst to senior and principal levels, with specializations in threat hunting, malware analysis, and adversary tracking. Find a role that fits below and apply directly.
Find JobsOverview
Showing 5 of 29+ Cyber Threat Intelligence Analyst jobs
The Cyber Operations & Threat Intelligence Integration Lead will directly support the TRMC Chief Security Officer (CSO) to institutionalize, executing, and scaling the end-to-end information flow of actionable cyber threat intelligence and operational cyber data across the MRTFB. The incumbent will design, establish, and facilitate a recurring battle rhythm of classified operational syncs (Secret and TS/SCI), liaise directly with the RCC CSG, maintain technical artifact sharing for COTS vetting, and ensure rapid response to urgent Cyber Tasking Orders (CTOs).
- Designing and executing a recurring classified meeting structure on Secret and TS/SCI networks
- Initiating operations at a weekly cadence to rapidly clear the historical information backlog, transitioning to a bi-weekly sustainment schedule as coordination matures
- Managing all end-to-end administration for the classified syncs, to include:
- Identifying and validating appropriate points of contact (POCs) across all Army, Navy, and Air Force ranges
- Creating and maintaining secure invitee rosters and access verification lists
- Drafting and disseminating secure meeting announcements, read-aheads, and structured agendas
- Capturing highly technical discussion points, action items, and outstanding requirements
- Synthesizing complex cyber threat intelligence and operational discussions into executive-ready summaries (EXSUMs), decision records, and formal leadership briefings within 24 hours of session completion
- Monitoring, analyzing, and translating incoming intelligence feeds, national-level cyber threat reports, and emerging Cyber Tasking Orders (CTOs) published.
- Converting highly complex technical intelligence and adversary Tactics, Techniques, and Procedures (TTPs) into clear, actionable defensive priorities tailored for range enclaves and local security postures
- Interfacing directly with technical cyber teams conducting Supply Chain Risk Management (SCRM) checks and vulnerability scanning
- Coordinating the efficient delivery of these assessment artifacts to ranges to assist them in building the required “body of evidence” for local enclave software approvals
- Building and managing an enterprise-wide Action Item Tracking system to log range-specific inquiries, technical disconnects, and outstanding resource requests
- Driving accountability by coordinating directly with service cyber leads and Range Commanders Council (RCC) representatives to resolve tracked actions
- Assisting ranges in identifying, cataloging, and mapping their top critical test systems and determining the specific protective measures and data feeds required to secure those environments
#LI-HK1
Requirements:- Active DoD Top Secret with current SCI eligibility (verified in DISS)
- 8+ years of progressive experience in DoD cybersecurity, cyber threat intelligence, defensive cyberspace operations (DCO), or RDT&E range defense
- Strong understanding of USCYBERCOM operational constructs, Cyber Tasking Orders (CTOs), Cybersecurity Service Provider (CSSP) methodologies, and cyber threat intelligence frameworks (e.g., MITRE ATT&CK, D3FEND)
- Experience leading and facilitating classified technical meetings with military, civilian, and contractor stakeholders
- Demonstrated ability to author clear, concise executive-level staff products (EXSUMs, Information Papers, formal briefs)
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline
- Must meet DoD 8140/8570 IAM/IAT Level III baseline requirements (e.g., CISSP, CISM, GSLC)
- Prior direct experience supporting TRMC, MRTFB installations, or the Range Commanders Council (RCC) Cybersecurity Group
- Familiarity with Operational Technology (OT), telemetry systems, industrial control systems (ICS), and specialized military test range environments
- Master’s degree in a technical or public policy field; graduate of military defensive cyberspace or intelligence-specific training pipelines
SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE TOP SECRET / SCI LEVEL
Travel Requirements:
- None
Scientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.
SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.
The Cyber Operations & Threat Intelligence Integration Lead will directly support the TRMC Chief Security Officer (CSO) to institutionalize, executing, and scaling the end-to-end information flow of actionable cyber threat intelligence and operational cyber data across the MRTFB. The incumbent will design, establish, and facilitate a recurring battle rhythm of classified operational syncs (Secret and TS/SCI), liaise directly with the RCC CSG, maintain technical artifact sharing for COTS vetting, and ensure rapid response to urgent Cyber Tasking Orders (CTOs).
- Designing and executing a recurring classified meeting structure on Secret and TS/SCI networks
- Initiating operations at a weekly cadence to rapidly clear the historical information backlog, transitioning to a bi-weekly sustainment schedule as coordination matures
- Managing all end-to-end administration for the classified syncs, to include:
- Identifying and validating appropriate points of contact (POCs) across all Army, Navy, and Air Force ranges
- Creating and maintaining secure invitee rosters and access verification lists
- Drafting and disseminating secure meeting announcements, read-aheads, and structured agendas
- Capturing highly technical discussion points, action items, and outstanding requirements
- Synthesizing complex cyber threat intelligence and operational discussions into executive-ready summaries (EXSUMs), decision records, and formal leadership briefings within 24 hours of session completion
- Monitoring, analyzing, and translating incoming intelligence feeds, national-level cyber threat reports, and emerging Cyber Tasking Orders (CTOs) published.
- Converting highly complex technical intelligence and adversary Tactics, Techniques, and Procedures (TTPs) into clear, actionable defensive priorities tailored for range enclaves and local security postures
- Interfacing directly with technical cyber teams conducting Supply Chain Risk Management (SCRM) checks and vulnerability scanning
- Coordinating the efficient delivery of these assessment artifacts to ranges to assist them in building the required “body of evidence” for local enclave software approvals
- Building and managing an enterprise-wide Action Item Tracking system to log range-specific inquiries, technical disconnects, and outstanding resource requests
- Driving accountability by coordinating directly with service cyber leads and Range Commanders Council (RCC) representatives to resolve tracked actions
- Assisting ranges in identifying, cataloging, and mapping their top critical test systems and determining the specific protective measures and data feeds required to secure those environments
#LI-HK1
Requirements:- Active DoD Top Secret with current SCI eligibility (verified in DISS)
- 8+ years of progressive experience in DoD cybersecurity, cyber threat intelligence, defensive cyberspace operations (DCO), or RDT&E range defense
- Strong understanding of USCYBERCOM operational constructs, Cyber Tasking Orders (CTOs), Cybersecurity Service Provider (CSSP) methodologies, and cyber threat intelligence frameworks (e.g., MITRE ATT&CK, D3FEND)
- Experience leading and facilitating classified technical meetings with military, civilian, and contractor stakeholders
- Demonstrated ability to author clear, concise executive-level staff products (EXSUMs, Information Papers, formal briefs)
- Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline
- Must meet DoD 8140/8570 IAM/IAT Level III baseline requirements (e.g., CISSP, CISM, GSLC)
- Prior direct experience supporting TRMC, MRTFB installations, or the Range Commanders Council (RCC) Cybersecurity Group
- Familiarity with Operational Technology (OT), telemetry systems, industrial control systems (ICS), and specialized military test range environments
- Master’s degree in a technical or public policy field; graduate of military defensive cyberspace or intelligence-specific training pipelines
SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE TOP SECRET / SCI LEVEL
Travel Requirements:
- None
Scientific Research Corporation is an advanced information technology and engineering company that provides innovative products and services to government and private industry, as well as independent institutions. At the core of our capabilities is a seasoned team of highly skilled engineers and scientists with multidisciplinary backgrounds. This team is challenged daily to provide cutting edge technology solutions to our clients.
SRC offers a generous benefit package, including medical, dental, and vision plans, 401(k) with a company match, life insurance, vacation and sick paid time off accruals with amounts increasing based on role and years of service, 11 paid holidays, tuition reimbursement, and a work environment that encourages excellence and more. For positions requiring a security clearance, selected applicants will be subject to a government security investigation and must meet eligibility requirements for access to classified information.
See All 29 Cyber Threat Intelligence Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsCyber Threat Intelligence Analyst Job Market
Who's Hiring
Top Industries Hiring
- Accounting & Auditing
- Technology & Software
What Employers Look For
The qualifications that appear most often in cyber threat intelligence analyst jobs.
- Proficiency with MITRE ATT&CK framework and structured analytic techniques
- Experience producing finished intelligence reports for technical and executive audiences
- Hands-on use of SIEM platforms, threat intelligence platforms, or sandbox environments
- Active or adjudicated Secret or Top Secret security clearance
- Relevant certifications such as GCTI, CTI, or CISSP
- Bachelor's degree in cybersecurity, computer science, or a related technical field
Tips for Your Cyber Threat Intelligence Analyst Job Search
Tailor your resume to threat intel frameworks
Hiring managers scan for MITRE ATT&CK, Diamond Model, and kill chain references. Map your past work to these frameworks explicitly so your resume speaks the same language as the job description before a recruiter ever reads it.
Showcase finished intelligence products you have authored
Listing tools you have used is not enough. Describe specific threat reports, actor profiles, or tactical briefs you produced, who consumed them, and what decisions they informed. Concrete deliverables separate mid-career analysts from entry-level candidates.
Apply early to roles that fit
Migrate Mate lists cyber threat intelligence analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Target openings by clearance requirement first
Many postings require an active TS or TS/SCI clearance and will not move uncleared candidates forward. Filter by clearance level before applying so you focus your time on roles where you are already eligible and can start quickly.
Prepare to demonstrate a live analysis exercise
Many interviews include a take-home or whiteboard scenario where you pivot on an indicator of compromise in real time. Practice walking through your analytic process out loud, from raw data collection through a finished assessment, using a sanitized past case.
Negotiate your access to tooling and data feeds
Offer quality in threat intel depends heavily on the vendor feeds and internal telemetry a team has licensed. Before accepting, ask what commercial feeds, sandbox environments, and SIEM integrations are in place so you know what you are actually working with.
Cyber Threat Intelligence Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most cyber threat intelligence analysts?
The most active employers for cyber threat intelligence analysts right now are Leidos, MITRE, and EY, and the most openings are in Virginia, Florida, and Texas, based on current listings on Migrate Mate as of November 2026. Defense contractors, major financial institutions, and large healthcare systems account for a significant share of total demand.
How many cyber threat intelligence analyst jobs are remote?
About 38% of cyber threat intelligence analyst openings are fully remote or hybrid as of November 2026, though roles tied to classified networks or government contracts are almost always on-site. Strategic and finished-intelligence roles that do not require access to classified systems or sensitive internal telemetry tend to have the most remote flexibility.
How do you become a cyber threat intelligence analyst?
Start by building foundational skills in networking, operating systems, and log analysis, then develop hands-on experience with threat hunting or incident response to understand how adversaries behave. Earn a recognized certification such as GCTI or complete a dedicated CTI training program. Build a portfolio of written analytic products, even from open-source exercises, and apply to junior analyst or all-source intelligence roles to gain professional experience.
Can you get a cyber threat intelligence analyst job with little experience?
Yes, entry-level positions exist, particularly at managed security service providers and companies with large security operations centers that need analysts to triage raw indicators. Candidates with strong open-source intelligence skills, published threat research, CTF participation, or a background in military or law enforcement intelligence have the most success breaking in without a lengthy commercial resume.
What does the cyber threat intelligence analyst interview process look like?
Most processes include an initial screen with a recruiter, a technical phone interview covering analytic tradecraft and tool familiarity, and a final round that typically includes a scenario exercise where you pivot on a threat actor or indicator of compromise. Some employers add a take-home intelligence report assignment. Senior roles often include a presentation to leadership where you defend your analytic conclusions and sourcing.
Where can I find and apply to cyber threat intelligence analyst jobs?
You can find and apply to cyber threat intelligence analyst jobs on Migrate Mate, which lists current openings from employers across the United States. Search the available roles, find the ones that match your background and clearance level, and apply directly to each listing.
See All 29 Cyber Threat Intelligence Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs