Green Card Threat Intelligence Analyst Jobs
Threat Intelligence Analyst roles qualify for EB-2 and EB-3 green card sponsorship through the PERM labor certification process, which leads to permanent residency rather than a temporary visa. Employers file with DOL and USCIS on your behalf. Finding companies with active sponsorship history is the first practical step.
Find Green Card Threat Intelligence Analyst JobsOverview
Showing 5 of 19+ Threat Intelligence Analyst jobs
See all Threat Intelligence Analyst Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Threat Intelligence Analyst roles.
Get Access To All JobsINTRODUCTION
GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation's top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.
GENERAL DESCRIPTION
We are looking for a skilled threat actor communications and engagement professional to support GuidePoint's Digital Forensics and Incident Response practice within the GuidePoint Research and Intelligence Team (GRIT). The primary function of this role will be threat actor communications (also known as threat actor engagement, or ransomware negotiations) for GuidePoint's clients, collecting intelligence and advising digital extortion victims of appropriate courses of action aligned to their business needs. This is a client-facing role, requiring tact, professionalism, and a robust understanding of threat actor behavior and organization. The ideal candidate will also support GRIT's intelligence research efforts, operationalizing threat intelligence data obtained through threat actor engagement and digital forensics efforts.
The Threat Actor Engagement and Intelligence Consultant will be required to demonstrate strong client-facing consulting skills, calm under pressure, communications ability, and initiative under circumstances with unclear or incomplete guidance.
ABOUT THE GUIDEPOINT RESEARCH AND INTELLIGENCE TEAM
GRIT provides managed Threat Intelligence and Exposure Management services, Deep and Dark Web investigations, threat actor engagement, threat briefings, and advisory consulting in CTI operationalization, maturity, and program development. In each of these services, our goal is to better secure and prepare our clients to build, implement, and improve their security and CTI programs through advisory, instruction, assistance, or direct support.
Additionally, GRIT supports GuidePoint's DFIR practice, providing Threat Intelligence support to active intrusion investigations and response efforts, or informing DFIR advisory efforts and tabletop exercises. GRIT performs independent threat research into Ransomware and the cybercrime threat landscape, contributing to quarterly and annual reports, as well as Requests For Information (RFIs) and media inquiries.
GuidePoint Security's GRIT service offerings evolve in response to emerging threats and diverse client needs, and your creativity and expertise will assist the GRIT Practice with adapting to this rapidly changing environment.
ROLES AND RESPONSIBILITIES
- Lead and conduct Threat Actor Communications engagements, advising clients, legal counsel, and insurance carriers on risks, benefits, and key considerations for communication with threat actors in ransomware and data extortion cases.
- Operate as a technical resource within the Practice and actively participate in DFIR investigations to share and identify actionable intelligence.
- Effective engagement communication, time management, and collaboration with peers and clients. Foster client relationships by providing support, information, and guidance.
- Author comprehensive engagement deliverables that are tailored to both technical and managerial audiences; fully detail the technical findings, recommendations, business impact, and realistic remediation strategies.
- Utilize automation, orchestration, and scripting to reduce manual processes, improving overall efficiency while also enabling new capabilities to meet the rapidly changing needs of our clients.
- Contribute to integration of existing and future open-source and commercial tools or automation to help improve GRIT processes and procedures.
- Perpetually strengthen relevant skills, knowledge, and abilities to stay at the forefront of the information security industry.
- Maintain a strong desire to learn, adapt, and improve along with a rapidly growing company.
- Willingness and ability to support a rotating on-call schedule, including possible weekend work as needed to support emergency requirements.
BASIC QUALIFICATIONS
- 2 - 4 years prior experience in communicating with threat actors, such as through virtual persona operations, ransomware negotiations, or use of "sock puppet" accounts in Deep and Dark Web collection.
- Two (2+) years of experience performing Threat Intelligence analysis and/or collection.
- Prior experience in intelligence sharing relationships and partnerships within the private sector, ISACs, government, and/or private intelligence sharing groups.
- Prior experience in building and developing persona operations, including familiarity with dark web forums and marketplaces, adversary behavior, and trust mechanisms.
- Familiarity with digital forensics and incident response workflows, processes, and deliverables.
- Experience in client-facing, professional services, or consulting roles.
- Experience using emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.
PREFERRED QUALIFICATIONS
- Familiarity with cryptocurrency tracing and blockchain technology.
- Experience implementing or improving operational processes or procedures in the intelligence lifecycle.
- Proficiency hunting APT data using open source or commercial cyber threat analytic tools or data repositories such as VirusTotal, Passive Total, Threat Miner, or Maltego.
- Experience in scoping and conducting threat research centered on cybercrime, ransomware, and/or nation-state cyber operation.
TRAVEL REQUIREMENTS
- Travel not required.
Physical Requirements
- Sedentary work.
- Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day.
- Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day.
WHY GUIDEPOINT?
GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.
Firmly-defined core values drive all aspects of the business, which have been paramount to the company's success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.
This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.
SOME ADDED PERKS….
- Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions).
- Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options).
- Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans.
- 12 corporate holidays and a Flexible Time Off (FTO) program.
- Healthy mobile phone and home internet allowance.
- Eligibility for retirement plan after 2 months at open enrollment.
- Pet Benefit Option.
INTRODUCTION
GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation's top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.
GENERAL DESCRIPTION
We are looking for a skilled threat actor communications and engagement professional to support GuidePoint's Digital Forensics and Incident Response practice within the GuidePoint Research and Intelligence Team (GRIT). The primary function of this role will be threat actor communications (also known as threat actor engagement, or ransomware negotiations) for GuidePoint's clients, collecting intelligence and advising digital extortion victims of appropriate courses of action aligned to their business needs. This is a client-facing role, requiring tact, professionalism, and a robust understanding of threat actor behavior and organization. The ideal candidate will also support GRIT's intelligence research efforts, operationalizing threat intelligence data obtained through threat actor engagement and digital forensics efforts.
The Threat Actor Engagement and Intelligence Consultant will be required to demonstrate strong client-facing consulting skills, calm under pressure, communications ability, and initiative under circumstances with unclear or incomplete guidance.
ABOUT THE GUIDEPOINT RESEARCH AND INTELLIGENCE TEAM
GRIT provides managed Threat Intelligence and Exposure Management services, Deep and Dark Web investigations, threat actor engagement, threat briefings, and advisory consulting in CTI operationalization, maturity, and program development. In each of these services, our goal is to better secure and prepare our clients to build, implement, and improve their security and CTI programs through advisory, instruction, assistance, or direct support.
Additionally, GRIT supports GuidePoint's DFIR practice, providing Threat Intelligence support to active intrusion investigations and response efforts, or informing DFIR advisory efforts and tabletop exercises. GRIT performs independent threat research into Ransomware and the cybercrime threat landscape, contributing to quarterly and annual reports, as well as Requests For Information (RFIs) and media inquiries.
GuidePoint Security's GRIT service offerings evolve in response to emerging threats and diverse client needs, and your creativity and expertise will assist the GRIT Practice with adapting to this rapidly changing environment.
ROLES AND RESPONSIBILITIES
- Lead and conduct Threat Actor Communications engagements, advising clients, legal counsel, and insurance carriers on risks, benefits, and key considerations for communication with threat actors in ransomware and data extortion cases.
- Operate as a technical resource within the Practice and actively participate in DFIR investigations to share and identify actionable intelligence.
- Effective engagement communication, time management, and collaboration with peers and clients. Foster client relationships by providing support, information, and guidance.
- Author comprehensive engagement deliverables that are tailored to both technical and managerial audiences; fully detail the technical findings, recommendations, business impact, and realistic remediation strategies.
- Utilize automation, orchestration, and scripting to reduce manual processes, improving overall efficiency while also enabling new capabilities to meet the rapidly changing needs of our clients.
- Contribute to integration of existing and future open-source and commercial tools or automation to help improve GRIT processes and procedures.
- Perpetually strengthen relevant skills, knowledge, and abilities to stay at the forefront of the information security industry.
- Maintain a strong desire to learn, adapt, and improve along with a rapidly growing company.
- Willingness and ability to support a rotating on-call schedule, including possible weekend work as needed to support emergency requirements.
BASIC QUALIFICATIONS
- 2 - 4 years prior experience in communicating with threat actors, such as through virtual persona operations, ransomware negotiations, or use of "sock puppet" accounts in Deep and Dark Web collection.
- Two (2+) years of experience performing Threat Intelligence analysis and/or collection.
- Prior experience in intelligence sharing relationships and partnerships within the private sector, ISACs, government, and/or private intelligence sharing groups.
- Prior experience in building and developing persona operations, including familiarity with dark web forums and marketplaces, adversary behavior, and trust mechanisms.
- Familiarity with digital forensics and incident response workflows, processes, and deliverables.
- Experience in client-facing, professional services, or consulting roles.
- Experience using emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.
PREFERRED QUALIFICATIONS
- Familiarity with cryptocurrency tracing and blockchain technology.
- Experience implementing or improving operational processes or procedures in the intelligence lifecycle.
- Proficiency hunting APT data using open source or commercial cyber threat analytic tools or data repositories such as VirusTotal, Passive Total, Threat Miner, or Maltego.
- Experience in scoping and conducting threat research centered on cybercrime, ransomware, and/or nation-state cyber operation.
TRAVEL REQUIREMENTS
- Travel not required.
Physical Requirements
- Sedentary work.
- Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day.
- Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day.
WHY GUIDEPOINT?
GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.
Firmly-defined core values drive all aspects of the business, which have been paramount to the company's success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.
This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.
SOME ADDED PERKS….
- Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions).
- Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options).
- Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans.
- 12 corporate holidays and a Flexible Time Off (FTO) program.
- Healthy mobile phone and home internet allowance.
- Eligibility for retirement plan after 2 months at open enrollment.
- Pet Benefit Option.
See all Green Card Threat Intelligence Analyst Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Green Card Threat Intelligence Analyst Jobs.
Get Access To All JobsTips for Finding Green Card Sponsorship as a Threat Intelligence Analyst
Document your SOC code before applying
Threat Intelligence Analysts typically fall under SOC 15-1212 (Information Security Analysts). Confirm your target employer's PERM filing uses a matching SOC code, a mismatch between your duties and the certified job description can derail an otherwise clean I-140 petition.
Target employers already enrolled in E-Verify
E-Verify enrollment signals that a company has active immigration infrastructure. Defense contractors, federal IT vendors, and financial institutions in this space routinely sponsor EB-2 and EB-3 petitions and are familiar with the prevailing-wage and recruitment requirements PERM demands.
Search sponsoring employers through Migrate Mate
Use Migrate Mate to filter Threat Intelligence Analyst roles by employers with verified green card sponsorship history. This saves weeks of manual DOL disclosure data research and surfaces active PERM filers directly in your job search.
Get a credential evaluation before PERM begins
If your cybersecurity or computer science degree is from outside the U.S., obtain a NACES-member evaluation before your employer files. PERM's minimum requirements section must reflect your actual qualifications, and a missing equivalency determination is one of the most common audit triggers.
Understand the PERM recruitment window and your role in it
Your employer must run DOL-mandated recruitment for at least 60 days before filing PERM. You can't apply for other positions with that same employer during this window without potentially resetting the clock, so coordinate your timeline carefully before the process starts.
Check prevailing wage level against your offer before filing
Use the OFLC Wage Search to verify your offered salary meets at least the DOL prevailing wage for your location and job zone. A wage level mismatch discovered after PERM is certified can block I-140 approval and waste months of processing time.
Green Card Threat Intelligence Analyst: Frequently Asked Questions
Does a Threat Intelligence Analyst role qualify for EB-2 or EB-3 sponsorship?
It can qualify for either, depending on how your employer structures the job description. EB-2 applies when the role requires an advanced degree or you have a bachelor's degree plus at least five years of progressive experience in cybersecurity or intelligence analysis. EB-3 covers positions requiring a standard bachelor's degree. Most mid-to-senior threat analyst roles meet EB-2 requirements, but your employer's PERM filing controls the category.
How does green card sponsorship differ from H-1B for this role?
Green card sponsorship through PERM and I-140 targets permanent residency, not a temporary status. There's no annual lottery, and EB-3 petitions face no per-country cap at the petition stage. The tradeoff is timeline: PERM, I-140, and adjustment of status typically take two to four years for most countries, compared to H-1B visa's faster initial approval. However, the outcome is lawful permanent residence, not a status you need to keep renewing.
Which employers typically sponsor Threat Intelligence Analyst green cards?
Defense contractors, managed security service providers, financial institutions, and large federal IT vendors file PERM petitions most consistently for this role. These employers have established immigration teams and are familiar with the DOL recruitment and prevailing-wage requirements that PERM demands. Use Migrate Mate to identify companies with active green card sponsorship history for this specific job title rather than relying on general employer reputation.
What credentials strengthen a PERM-based sponsorship case for this role?
A bachelor's degree in computer science, information security, or a related field is the baseline. Certifications such as GIAC, CISSP, or CEH reinforce the specialty occupation argument for EB-2 cases. If your degree is from outside the U.S., a credential evaluation from a NACES-recognized organization is required before your employer files. Industry-recognized threat intelligence frameworks experience, such as MITRE ATT&CK, further supports the advanced-degree professional classification.
Can my employer start PERM while I'm on a work visa in the U.S.?
Yes. PERM can begin while you hold valid H-1B, L-1 visa, or other work authorization. Starting early is practical because PERM itself takes six months to a year for DOL to certify, and the I-140 and adjustment of status stages add additional time. Your current visa status remains independent of the PERM process, so a pending PERM filing doesn't affect your existing work authorization.