Senior Cyber Threat Intelligence Analyst

S&P Global Mobility; Monterrey; Hybrid; MXN 850,000 - 1,276,000; Full time

Job summary

Mobility Global, CARFAX division, Monterrey, Mexico, seeks a senior Cyber Threat Intelligence professional to own the CTI program end-to-end. You will define processes, monitor intel from multiple sources, and produce actionable briefs for Cyber Defense.

You will implement AI-assisted workflows, collaborate with DFIR and Threat Hunting teams, and translate intel into detection context with Google SecOps.

Qualifications

• 4+ years of hands-on experience in cyber threat intelligence.
• Experience with commercial threat intel platforms (e.g., Recorded Future, Flashpoint, Mandiant, Google Threat Intel, CrowdStrike).
• Strong understanding of threat intel lifecycle and frameworks (MITRE ATT&CK, Cyber Kill Chain).
• Experience implementing AI aids to CTI operations and running an intel program end to end.
• Excellent written and verbal communication; ability to document solutions, detections and workflows.

Responsibilities

• Own and run the CTI program end to end from collection through analysis, production and dissemination.
• Define and mature the CTI processes, standards, and roadmap.
• Serve as primary contact for cyber threat intel across Cyber Defense.
• Monitor and analyze intel from commercial platforms and open sources; manage sources and subscriptions.
• Produce actionable intelligence products: briefs, reports, and actor profiles.
• Track threat actors, campaigns, and TTPs relevant to the industry.
• Implement AI agents to support CTI operations and accelerate triage of data.
• Partner with DFIR/Threat Hunting to feed intel into investigations and hunts.
• Collaborate with Security Engineering to translate intel into detection context.

Skills

Cyber threat intel

Threat intel platforms

MITRE ATT&CK

AI in security

Communication skills

Tools

Recorded Future

Flashpoint

Mandiant Threat Intel

Google Threat Intel

CrowdStrike Falcon

Job description

Location: Monterrey, Mexico | Employer: R.L. Polk S. de R.L. de C.V.

Why Mobility Global?

At Mobility Global, our mission is to provide the trusted information that helps billions of people build, sell, and own vehicles with confidence. As we shape the next generation of automotive intelligence through innovation, AI, and industry-leading data, we are creating new opportunities for our customers, our business, and our people.

CARFAX, a division of Mobility Global, helps millions of people every day confidently shop, buy, service and sell used cars with innovative solutions powered by CARFAX vehicle history information. Shop, Buy, Service, Sell – Show me the CARFAX.

What You'll Do

• Own and run the Cyber Threat Intelligence (CTI) program end to end, from collection through analysis, production, dissemination, and feedback.
• Define and continuously mature the CTI program’s processes, standards, and roadmap.
• Serve as the primary point of contact and subject matter expert for cyber threat intelligence across Cyber Defense.
• Monitor, collect, and analyze intelligence from commercial threat intel platforms and open source and public sources, and manage and prioritize platform subscriptions and sources to maximize relevance and value.
• Produce structured, actionable intelligence products, including strategic, operational, and tactical briefs, indicator and TTP reports, and threat actor profiles.
• Track threat actors, campaigns, and TTPs relevant to the organization’s industry and threat landscape.
• Implement AI agents and AI-assisted workflows to support CTI operations, such as automating source monitoring, synthesizing intelligence from multiple platforms into structured briefs, and accelerating triage of raw threat data.
• Partner with DFIR and Threat Hunting teams, feeding intelligence into investigations and hunts and incorporating their findings back into the intelligence picture.
• Partner with Security Engineering to translate intelligence into detection context within Google SecOps.

What We're Looking For

Required Qualifications

• 4+ years of hands-on experience in cyber threat intelligence.
• Experience working with commercial threat intel platforms such as Recorded Future, Flashpoint, Mandiant Threat Intel, Google Threat Intel, CrowdStrike Falcon, or similar.
• Strong understanding of the threat intelligence lifecycle and common frameworks such as MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain.
• Demonstrated experience implementing AI agents or tools to support CTI operations, and a proven ability to independently own and run an intelligence program end to end, without relying on a larger team.
• Strong analytical and problem-solving skills, with the ability to independently investigate and resolve complex technical challenges, and excellent written and verbal communication skills, including the ability to document technical solutions, detections, workflows, and operational procedures.

Expected Hours of Work: This is a full-time position. Work is generally performed Monday through Friday; however, limited participation in on-call rotations, after-hours escalations, weekends, and holidays may be required to support cybersecurity operations and major incidents.

Travel Requirements: Up to 10% of domestic and international travel may be required. Travel may include team meetings, training events, leadership workshops, cybersecurity conferences, and operational reviews.

This is a hybrid role. The in-office and remote arrangement will be set out in the employment contract.

Applicants must be legally authorized to work in Mexico at the time of hire. The company is unable to provide immigration or work permit support for this position.

The gross annual base salary for this position is $850,000 - $1,276,000 MXN. The final offer will be based on experience, skills, and qualifications, consistent with the principle of equal pay for equal work.

Equal Opportunity

Mobility Global is committed to equal opportunity and non-discrimination in accordance with Mexican law. Hiring decisions are not based on origin, sex, gender, sexual orientation, age, disability, health, pregnancy, religion, marital status, appearance, or any other characteristic protected by law. We provide reasonable accommodations for candidates with disabilities.

Privacy Notice

R.L. Polk S. de R.L. de C.V., with address at Avenida Constitución 2050, Monterrey, NL 64000, Mexico, processes your personal data to evaluate your application. Please do not include sensitive personal data or a photo in your CV.