Senior Cyber Threat Intelligence (CTI) Analyst

Live Nation, Inc; Greater London; On-site; GBP 80,000 - 110,000; Full time

Benefits offered by this job

Remote-friendly

Free live events access

Generous vacation and healthcare

Job summary

Live Nation Entertainment is seeking a Senior Cyber Threat Intelligence Analyst to drive hands-on threat research and intelligence across our global operations. You will analyze threat actors and campaigns, produce tactical and strategic intelligence, and collaborate with Detection Engineering, Incident Response, and Threat Hunting to elevate the CTI program.

The role requires 5+ years in CTI, strong reporting skills, and experience with OSINT, dark web sources, and CTI tools.

Qualifications

• 5+ years hands-on CTI experience in a dedicated CTI or threat intelligence function.
• Experience tracking threat actors, adversaries, campaigns, IOC/TPP analysis using MITRE ATT&CK.
• Strong ability to produce clear threat intelligence reports for technical and non-technical stakeholders.

Responsibilities

• Conduct hands-on cyber threat intelligence analysis focused on threat actors, campaigns, TTPs, infrastructure, malware, phishing, ransomware.
• Produce tactical, operational, and strategic intelligence products including threat assessments and executive briefings.
• Own and support the intelligence lifecycle from requirements to dissemination and feedback.
• Translate raw threat data from OSINT, dark web, and telemetry into actionable intelligence.
• Conduct technical research on infrastructure, tooling, and tradecraft used by threat actors.
• Surface detection opportunities and turn them into detection content like YARA, Sigma, or SIEM queries.
• Support threat hunting and incident response with intelligence-driven context.
• Develop Priority Intelligence Requirements and reporting processes to improve CTI outputs.
• Brief leadership on threats, trends, and business impact; mentor junior analysts.

Skills

Threat intelligence analysis

MITRE ATT&CK

Threat actor tracking

Cybersecurity knowledge

Python scripting

Tools

MISP

ThreatConnect

EclecticIQ

Anomali

Threat hunting tools

Job description

Job Summary: Senior Cyber Threat Intelligence (CTI) Analyst UK (9:00 AM – 18:00 PM GMT) Live Nation Entertainment – Cyber Security Operations, Cyber Security

THE TEAM

Live Nation is seeking a Senior Cyber Threat Intelligence (CTI) Analyst to drive hands‑on intelligence analysis and research across our global environment. This role sits within the Detection and Response Engineering, CTI, and Threat Hunting team. The team focuses on identifying emerging threats, conducting in-depth analysis of malicious activity, and enhancing the organization’s security posture, detection, and incident response capabilities.

THE ROLE

This is a hands‑on senior individual contributor role for an analyst who wants to stay technical: researching threat actors and their infrastructure, digging into malware and phishing campaigns, tracking ransomware and the cybercrime ecosystems targeting live entertainment, ticketing, and e‑commerce, and turning that research into intelligence that drives decisions. The CTI Analyst will work cross‑functionally with Detection Engineering, Incident Response, Threat Hunting, Vulnerability Management, Fraud, and external partners to provide actionable intelligence, and will help mature the CTI program while remaining closely engaged in day‑to‑day analysis.

WHAT THIS ROLE WILL DO

• Conduct hands‑on cyber threat intelligence analysis focused on threat actors, campaigns, tactics, techniques, procedures, infrastructure, malware, phishing activity, ransomware, and the cybercrime ecosystems targeting live entertainment, ticketing, and e‑commerce.
• Produce tactical, operational, and strategic intelligence products including threat assessments, intelligence reports, executive briefings, RFIs, threat actor profiles, and actionable recommendations for stakeholders.
• Own and support the intelligence lifecycle, including requirements gathering, collection, analysis, enrichment, dissemination, and feedback.
• Translate raw threat data, OSINT, vendor intelligence, dark web research, internal telemetry, and partner reporting into clear, actionable intelligence.
• Conduct technical research on malicious infrastructure, tooling, and tradecraft used by threat actors, including infrastructure pivoting, malware and phishing kit triage, and campaign attribution analysis.
• Surface detection opportunities from technical research and partner with Detection Engineering to turn them into detection content such as YARA, Sigma, or SIEM queries.
• Support threat hunting, detection engineering, incident response, vulnerability management, fraud, and broader cyber defence teams with intelligence‑driven context and prioritisation.
• Develop and refine Priority Intelligence Requirements, collection priorities, analytical workflows, and reporting processes to improve the quality and relevance of CTI outputs.
• Analyse threat actor behaviour and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk‑based decision‑making.
• Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions.
• Mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review.
• Help mature CTI processes, tools, reporting standards, and intelligence outputs while remaining closely engaged in hands‑on analysis.
• Support the development and automation of threat analysis workflows and tooling, and operate threat intelligence platforms such as MISP, ThreatConnect, EclecticIQ, or Anomali.
• Periodically participate in on‑call rotations and support incident response efforts.

WHAT THIS PERSON WILL BRING

5+ years of hands‑on cyber threat intelligence experience in a dedicated CTI, cyber intelligence, or threat intelligence function. Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behaviour. Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination, and stakeholder feedback. Proven ability to produce clear, actionable intelligence reports, assessments, briefings, and RFIs for technical and non‑technical stakeholders. Experience supporting threat hunting, incident response, detection engineering, vulnerability management, or security operations through intelligence outputs. Experience mentoring, guiding, or influencing other analysts as a senior individual contributor or functional lead. Strong knowledge of system, network, and application security, including Windows and Linux internals. Experience analysing threats using telemetry from SIEM, EDR, and TIP platforms, and familiarity with CTI tools and sources such as OSINT, dark web sources, ISACs, Recorded Future, Mandiant, Flashpoint, Anomali, ThreatConnect, or VirusTotal. Hands‑on experience investigating adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet‑scan data sources such as VirusTotal, DomainTools, Shodan, Censys, or urlscan.io. Experience triaging malware, phishing kits, or attacker tooling using sandbox or detonation environments and extracting IOCs, C2 infrastructure, and behavioural indicators. Proficiency in at least one query language (KQL, SPL, CQL, SQL), the ability to read and understand code, and working scripting ability (e.g., Python, Bash) for enrichment and automation. Strong written and verbal communication skills, including the ability to clearly explain methodology, analysis performed, intelligence produced, and resulting action, and to translate complex threat activity into business‑relevant risk. Cyber threat intelligence experience within live entertainment, ticketing, e‑commerce, payments, or another high‑volume consumer transaction environment. Experience building or maturing CTI processes such as Priority Intelligence Requirements, collection plans, reporting standards, RFI workflows, or intelligence dissemination models. Experience with ransomware, cybercrime, fraud‑related threat intelligence, third‑party exposure, or credential exposure analysis. Experience conducting dark web, underground forum, or cybercrime ecosystem research, including persona management and operational security tradecraft. Experience with static or dynamic malware analysis and reverse engineering using tools such as Ghidra, IDA, or x64dbg, or with network flow analysis and host forensics. Experience authoring detection content such as YARA, Sigma, or Suricata rules, or SIEM correlation searches. Experience tracking offensive tooling and C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic) across internet‑scan and telemetry data. Familiarity with STIX/TAXII, threat intelligence enrichment pipelines, or TIP administration and automation. Familiarity with cloud services and securing cloud environments (AWS, Azure, GCP). Exposure to AI use cases within cyber threat intelligence, such as intelligence collection, analysis acceleration, or reporting efficiency. Experience collaborating with external intelligence‑sharing groups such as ISACs, InfraGard, CISA, law enforcement, or intelligence community partners. Security certifications such as GCTI, GCFA, GREM, OSCP, or CISSP.

TECHNICAL COMPETENCIES

Advanced Analytical Skills

• Strong experience with question‑driven analysis and structured analytic techniques.
• Ability to analyse and correlate TTPs to an enterprise environment.
• Ability to analyse and step through code to obtain potential IOCs or detection opportunities.
• Ability to identify anomalies and trends across vast, unstructured datasets.
• Be curious.

Technical Research & Tradecraft

• Ability to investigate adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet‑scan data, pivoting from a single indicator to broader campaign infrastructure.
• Comfortable performing initial triage of malware samples, phishing kits, and attacker tooling in sandbox or detonation environments to extract IOCs, C2 configuration, and behavioural indicators.
• Working knowledge of common C2 frameworks, commodity malware families, and phishing ecosystems, and how they present in network and endpoint telemetry.
• Sound operational security practices for OSINT, dark web, and underground forum research, including persona and attribution management.
• Ability to script enrichment and automation against threat intelligence and security tool APIs.

Threat Intelligence Expertise

• Proven experience tracking advanced threat actors and financially motivated cybercrime groups, including campaign, IOC, and TTP analysis.
• Strong command of the intelligence lifecycle: requirements, collection, analysis, enrichment, dissemination, and feedback.
• Understanding of the MITRE ATT&CK framework and how to use the MITRE Navigator to structure analysis and communicate adversary behaviour.
• Skilled writer.
• The ability to author and peer review tactical, operational, and strategic intelligence products for both technical and executive audiences.
• Experience developing Priority Intelligence Requirements and collection priorities for a large organisation.

Collaboration & Communication

• Comfortable briefing technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions.
• Ability to read the room and adjust communications accordingly.
• Capable of operating within high‑stakes, time‑sensitive investigations.
• Mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review.
• Develop coalitions with other teams. We want to succeed through collaboration.

WHAT WE OFFER

A collaborative and inclusive environment focused on mentorship, diversity of thought, and continuous growth. Remote‑friendly and flexible work culture. Exposure to a wide range of threat landscapes across live entertainment, e‑commerce, and cloud infrastructure. A chance to directly shape the maturity and impact of Live Nation’s global threat intelligence function.

• 401(K) retirement program with employer match.
• Live Nation Entertainment will never request payment or equipment purchases as part of the hiring process.
• Recruiters will only contact candidates from official Live Nation or affiliated brand email domains.
• Recognised for seven years as a Great Place to Work® and named one of Fortune’s World’s Most Admired Companies.
• Generous vacation, healthcare, retirement benefits, student loan repayment, tuition reimbursement, six months of paid caregiver leave for new parents including fostering.
• Roadie Babies helping new parents care for their babies on work trips.
• Access to free live events through our exclusive employee ticketing programme.

There is no bigger stage for your career. See what your future looks like at Live Nation Entertainment.