Cyber Threat Intelligence Analyst (2 vagas) (Home Based) - [Open to internal and external applicants]

Better Than Cash; Brasília; Remote; BRL 120,000 - 160,000; Full time

Benefits offered by this job

Home-based position

Job summary

UNDP is seeking a Cyber Threat Intelligence Analyst for the BRA/25/025 project conducted in Brazil. The role is home-based, focused on collecting, analyzing and disseminating cyber threat intel to protect the Judiciary and public sector, coordinating with CNJ and UNDP teams.

The incumbent will build proactive detection, contribute to risk management, and produce intelligence outputs for operational use and executive decision-making.

Qualifications

• Advanced university degree in Information Security, IT, CS, or related fields; or
• Bachelor’s degree with two years’ qualifying experience in cyber threat intelligence.

Responsibilities

• Lead collection, analysis and dissemination of cyber threat intelligence to anticipate risks and strengthen judiciary resilience.
• Coordinate with CNJ and UNDP teams on threat intel production and sharing.
• Produce indicators of compromise and detection rules to feed SIEM, EDR, and IDS/IPS ecosystems.
• Support CTI platforms integration with SOAR and monitoring tools (e.g., MISP, OpenCTI).
• Develop threat intelligence reports and executive summaries for technical and management audiences.

Skills

CTI

OSINT

OPSEC

Python

Scripting

Education

Master’s degree in information security / IT

Bachelor’s degree + 2 years experience

Tools

MISP

OpenCTI

Job description

Tiered Approach

In line with the commitment to safeguard capacity and support personnel already in the Organization, a majority of UNDP UNCDF/UNV vacancies are advertised using a tiered application process whereby:

• Tier 0: UNDP/UNCDF/UNV IP staff holding permanent (PA) and fixed-term (FTA) appointments, whose posts will be abolished, or contracts will be terminated or not renewed during 2026.
• Tier 1: Other UNDP/UNCDF/UNV staff holding permanent (PA) and fixed-term (FTA) appointments
• Tier 2: UNDP/UNCDF/UNV staff holding temporary appointments (TA), personnel on regular PSA contracts, and Expert and Specialist UN Volunteers
• Tier 3 or no tier indicated: All other contract types from UNDP/UNCDF/UNV and other agencies, and other external candidates

Please make note of the Tier(s) indicated in the vacancy title, if any, and ensure that you satisfy the eligibility to apply.

Background

In 2025, the National Council of Justice (CNJ) and the United Nations Development Programme (UNDP) established a partnership aimed at promoting innovation in cybersecurity for the Brazilian Judiciary. Project BRA/25/025 develops and implements tools and strategies to strengthen cybersecurity, digital preservation and information integrity, expanding the protection of the Judiciary’s systems and users.

The initiative strengthens institutional security and promotes transparency, good governance and the efficiency of judicial processes, contributing to resource savings and to a more agile Justice system for the benefit of citizens and society.

To this end, the project governance is organized into the following fronts:

Four cross-cutting coordination axes:

• General Coordination;
• Integrated Monitoring and Control Unit;
• Technical and Operational Management Unit;
• Training and Communication Unit;

Four workstreams, focused on:

• Regulatory compliance;
• Operational conformity;
• Network governance;
• Promotion of a cybersecurity culture;

As this is a home-based position, the candidate is expected to have adequate working conditions, including the infrastructure and equipment necessary for the full performance of the activities.

Duties and Responsibilities

The Cyber Threat Intelligence Analyst will be assigned to the Network Governance axis and will be responsible for leading the collection, analysis and dissemination of cyber threat intelligence, with the aim of anticipating risks, enriching the understanding of incidents and threat actors, and strengthening the resilience of Judiciary institutions within the context of project BRA/25/025.

The incumbent will work in close coordination with the CNJ and UNDP teams, and the following indicative activities are foreseen:

Cyber Intelligence Coordination and Dissemination

• Engage in the threat information-sharing network among Judiciary bodies, ensuring the smooth flow of tactical and operational data.
• Produce intelligence inputs for operational alerts, threat advisories, and rapid dissemination bulletins for technical teams and managers.
• Facilitate cooperation with national and international Computer Security Incident Response Teams (CSIRTs) and public sector cooperation networks.
• Contribute to a proactive, forward-looking cyber defense posture for the Judiciary, anticipating threats based on the intelligence produced and shared.
• Support the operation and curation of intelligence-sharing platforms (e.g., MISP, OpenCTI), using standards such as STIX/TAXII and the Traffic Light Protocol (TLP) for the classification and dissemination of information.

Intelligence Production and Threat Analysis

• Conduct advanced analyses of threat actors, their motivations, capabilities and TTPs (Tactics, Techniques and Procedures), applying analytical models such as the Diamond Model and the Cyber Kill Chain.
• Transform raw data from technical, open and internal sources into actionable intelligence to support proactive defense and improve incident containment, observing operational security (OPSEC) best practices in collection activities.
• Support vulnerability prioritization based on the actual likelihood of exploitation in the current threat landscape.
• Monitor open sources, forums, deep and dark web channels, and national and international technical reports to identify campaigns, data leaks and threats targeting the public sector and the Judiciary.
• Define, maintain and periodically review Priority Intelligence Requirements (PIRs), ensuring intelligence production remains aligned with organizational risks, priorities and the evolving threat landscape.

Strengthening Proactive Detection

• Produce and provide indicators of compromise (IoCs), behavioral patterns and detection signatures/rules (e.g., YARA, Sigma, Snort/Suricata) to feed monitoring systems (SIEM, EDR, IDS/IPS, etc.).
• Collaborate with Blue Team, Threat Hunting and Incident Response teams to validate intrusion hypotheses based on threat intelligence.
• Assess the effectiveness of security coverage against techniques mapped in frameworks such as MITRE ATT&CK, identifying detection gaps and proposing adjustments.
• Support the automation and orchestration of intelligence workflows (collection, enrichment, correlation and distribution), integrating CTI platforms with SOAR and monitoring tools.
• Support the analysis of incident-related artifacts, logs and relevant technical evidence to extract relevant IoCs and TTPs.

Strategic Risk Management and Security Posture

• Contribute to periodic security posture reviews with an external view of threats specifically targeting the public sector and the Judiciary.
• Identify long-term cyberattack trends to guide investments and changes in the defense architecture.
• Propose improvements to technical controls based on the evolution of identified threats.
• Support External Attack Surface Management (EASM) activities by identifying exposed assets, leaked credentials and indicators of organizational exposure.

Integration with Capacity Building and Innovation

• Integrate real-world threat intelligence into Situational Awareness programs to raise user maturity against targeted attacks.
• Promote the use of CTI frameworks (e.g., MITRE ATT&CK, Diamond Model, Cyber Kill Chain), OPSEC best practices and security data analysis.

Continuity, Reporting and Simulations

• Participate in the development of realistic threat scenarios for crisis simulation exercises and continuity plans.
• Produce technical intelligence reports, threat assessments, and executive summaries tailored to technical teams and senior management.
• Conduct workshops and training on intelligence analysis for local teams.

Knowledge Management

• Document analysis methodologies and lessons learned from relevant incidents, and keep the knowledge base on sector adversaries up to date.
• Develop and maintain analytical templates, reporting standards and intelligence production guidelines to ensure consistency across the intelligence lifecycle.
• Promote the reuse of intelligence products across Incident Response, Threat Hunting, Vulnerability Management and Security Operations teams.

The incumbent performs other duties within their functional profile as deemed necessary for the efficient functioning of the Project.

Institutional Arrangement

The incumbent will be supervised by the Governance and Network Management Analyst.

Competencies

Core competencies

Achieve Results: LEVEL 1: Plans and monitors own work, pays attention to details, delivers quality work by deadline

Think Innovatively: LEVEL 1: Open to creative ideas/known risks, is pragmatic problem solver, makes improvements

Learn Continuously: LEVEL 1: Open minded and curious, shares knowledge, learns from mistakes, asks for feedback

Adapt with Agility: LEVEL 1: Adapts to change, constructively handles ambiguity/uncertainty, is flexible

Act with Determination: LEVEL 1: Shows drive and motivation, able to deliver calmly in face of adversity, confident

Engage and Partner: LEVEL 1: Demonstrates compassion/understanding towards others, forms positive relationships

Enable Diversity and Inclusion: LEVEL 1: Appreciate/respect differences, aware of unconscious bias, confront discrimination

Cross-Functional & Technical competencies

Business Direction & Strategy | Strategic Thinking:

Develop effective strategies and prioritized plans in line with UNDP’s objectives, based on the systemic analysis of challenges, potential risks and opportunities; link the general vision to reality on the ground to create tangible targeted solutions; learn from a variety of sources to anticipate and effectively respond to both current and future trends; demonstrate foresight

Business Direction & Strategy | Business Acumen:

Ability to understand and deal with a business situation in a manner that is likely to lead to a good outcome. Ability to make good judgments and quick decisions within such frameworks in the organization. Knowledge and understanding of the operational frameworks in the organization.

Business Development | Human-centered Design:

Ability to develop solutions to problems by involving the human perspective in all steps of the problem-solving process. Knowledge and understanding of human-centered design principles and practices.

Business Management | Project Management:

Ability to select, prioritise and control the organization's programmes and projects in line with its strategic objectives and capacity Ability to balance the implementation of change initiatives with regular activities for optimal return on investment. Knowledge and understanding of key principles of project, programme, and portfolio management.

Digital | Cyber and Data Privacy Security Risk Management:

Ability to anticipate, prepare for and respond to potential Risks and issues that may results in Data breaches that can cause potential identity theft and personal harm and can also negatively impact UNDP's reputation

2030 Agenda: Peace | Rule of Law, Security and Human Rights

Effective Justice Sector Institutions

Access to Justice

Required Skills and Experience

Min. Education requirements:

• Advanced university degree (Master’s degree or equivalent) in Information Security, Information Technology, Information Systems, Computer Science, Computer Engineering, Software Engineering, Telecommunications Engineering, Electrical Engineering or related fields is required, or
• A first-level university degree (Bachelor’s degree) in the areas mentioned above, in combination with an additional two years of qualifying experience will be given due consideration in lieu of the advanced university degree.

Min. years of relevant work experience:

• Applicants with Master’s degree (or equivalent) in a relevant field of study are not required to have professional work experience.
• Applicants with a Bachelor’s degree (or equivalent) are required to have a minimum of two (2) years of experience in Cyber Threat Intelligence.

Desired skills in addition to the competencies covered in the Competencies section:

• Recognized complementary training in CTI, OSINT, OPSEC, digital forensics or related areas.
• Previous experience in a Security Operations Center (SOC), CSIRT/CERT or dedicated threat intelligence team, preferably in the public sector or the justice system.
• Experience in collecting and analyzing open-source intelligence and in using cyber threat intelligence platforms (e.g., MISP, OpenCTI).
• Experience using scripting and query languages (e.g., Python, KQL, SPL) for collecting, parsing and analyzing large volumes of security data.
• Experience in writing technical and executive reports on cyber threats.
• Experience with the Brazilian legal and regulatory framework on cybersecurity and data protection.

Required Language(s):

• Fluency in Portuguese is required.
• Fluency in English is desirable.

Professional Certificates:

• N/A

Equal opportunity

As an equal opportunity employer, UNDP values diversity as an expression of the multiplicity of nations and cultures where we operate and, as such, we encourage qualified applicants from all backgrounds to apply for roles in the organization. Our employment decisions are based on merit and suitability for the role, without discrimination.

UNDP is also committed to creating an inclusive workplace where all personnel are empowered to contribute to our mission, are valued, can thrive, and benefit from career opportunities that are open to all.

Sexual harassment, exploitation, and abuse of authority

UNDP does not tolerate harassment, sexual harassment, exploitation, discrimination and abuse of authority. All selected candidates, therefore, undergo relevant checks and are expected to adhere to the respective standards and principles.

Right to select multiple candidates

UNDP reserves the right to select one or more candidates from this vacancy announcement. We may also retain applications and consider candidates applying to this post for other similar positions with UNDP at the same grade level and with similar job description, experience and educational requirements.

Use of AI by candidates

Applicants are invited to read UNDP’s guidance for candidates on using AI responsibly in UNDP recruitment and selection.

Data Privacy

Please click here to view UNDP Data Privacy Statement.

The Cyber Threat Intelligence Analyst will be assigned to the Network Governance axis and will be responsible for leading the collection, analysis and dissemination of cyber threat intelligence, with the aim of anticipating risks, enriching the understanding of incidents and threat actors, and strengthening the resilience of Judiciary institutions within the context of project BRA/25/025.

The incumbent will work in close coordination with the CNJ and UNDP teams.