Cyber Threat Intelligence Analyst

Andersen Lab; Osterreich; On-site; PEN 172,000 - 279,000; Full time

Job summary

Andersen is hiring a Cyber Threat Intelligence Analyst to strengthen cybersecurity capabilities for international organizations in a large, multi-tenant environment. You will collect and analyze threat intelligence, track actors and campaigns, and produce intelligence reports for technical and management audiences.

You will map threats to MITRE ATT&CK, contribute to SOC/SIEM detections, manage IOCs in the TIP, and support incident response with attribution and context.

Qualifications

• 5+ years in cybersecurity, with 3+ years in a dedicated CTI role.
• Hands-on with a threat intelligence platform (e.g. MISP, OpenCTI, ThreatConnect, Anomali, Recorded Future).
• Strong command of MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain.
• Experience OSINT research and malware/phishing analysis at indicator and TTP level.
• Experience turning intelligence into detections with a SOC/SIEM team.
• Clean professional records and willingness to undergo background verification.
• English level – Upper-Intermediate or higher.

Responsibilities

• Collect, analyze and correlate threat intelligence from OSINT and other sources.
• Track threat actors, campaigns and TTPs relevant to international organizations.
• Produce strategic, operational and tactical intelligence reports and briefings for technical and management audiences.
• Map threats to MITRE ATT&CK and turn intelligence into detections with SOC/SIEM teams.
• Manage IOCs and their lifecycle in the TIP and enrich SOC alerts and investigations.
• Support incident response with actor attribution and context.
• Share intelligence with partner organizations under agreed sharing protocols (TLP).

Skills

Threat Intelligence

MITRE ATT&CK

OSINT

Threat Hunting

Python scripting

Tools

MISP

OpenCTI

ThreatConnect

Anomali

Recorded Future

Job description

Andersen is hiring a Cyber Threat Intelligence Analyst for a project strengthening cybersecurity capabilities and identifying, assessing, and mitigating security risks.

Our customer is a technology and consulting organization providing digital infrastructure, cloud services, cybersecurity, data-driven solutions, and managed IT support. It helps organizations modernize complex technology environments, strengthen security, and improve the reliability and scalability of their digital operations. By combining technical expertise with modern technologies and service-oriented delivery, the company supports digital transformation, operational efficiency, and the continuous improvement of critical IT systems across multiple markets.

The project is focused on providing cybersecurity and digital services for international organizations within a large, heterogeneous, multi-tenant environment. It includes developing and strengthening vulnerability management capabilities to identify, assess, prioritize, and mitigate security risks across multiple organizations worldwide.

Responsibilities

• Collecting, analyzing and correlating threat intelligence from open, commercial and community sources (OSINT, ISACs, vendor feeds).
• Tracking threat actors, campaigns and TTPs relevant to international organizations, including state-sponsored groups.
• Producing strategic, operational and tactical intelligence reports and briefings for technical and management audiences.
• Mapping threats to MITRE ATT&CK and turning intelligence into detection use cases together with SOC and SIEM teams.
• Managing IOCs and their lifecycle in the TIP and enriching SOC alerts and incident investigations.
• Supporting incident response with actor attribution and context.
• Sharing intelligence with partner organizations under agreed sharing protocols (TLP).

Requirements

• Experience in cybersecurity for 5+ years, including 3+ years in a dedicated CTI role.
• Hands-on work with a threat intelligence platform (e.g. MISP, OpenCTI, ThreatConnect, Anomali, Recorded Future).
• Strong command of MITRE ATT&CK, the Diamond Model and the Cyber Kill Chain.
• Experience conducting OSINT research and analysis of malware and phishing campaigns at indicator and TTP level.
• Experience turning intelligence into detections together with a SOC or SIEM team.
• Clean professional records and willingness to undergo background verification.
• Level of English - from Upper-Intermediate and above.

Desired skills

• Certifications: GCTI, CTIA, GCIH.
• Experience with STIX/TAXII, YARA and Sigma.
• Experience in a public sector, international organization, NGO or financial sector environment.
• Skills scripting in Python for automation and data enrichment.

Reasons to join us

• Andersen cooperates with such companies as Siemens, Johnson & Johnson, AstraZeneca, BNP Paribas, Allianz, Ryanair, TUI, Verivox, Media Markt, etc..
• For the past four years, our company has been growing annually by 60-100%, and we constantly involve top-notch specialists in our team.
• Andersen has mentoring and adaptation systems for new employees, and transparent performance review and assessment systems will allow you to determine your development path and plan your growth.
• The most important thing that we value in our employees is a commitment to continuous learning. The company supports them in this and gives them access to the best educational platforms, seminars, and practices. In addition, for over 19 years, Andersen has assembled a huge knowledge base and established a robust resource management institution.
• We have been strengthening our expertise since 2007. During this time, we have formed excellent teams with streamlined processes, where you can learn something new from your colleagues every day and enjoy your work.
• We are a cool young team of like-minded people communicating informally.
• You'll have a stable and competitive salary and an extensive benefits package.
• At Andersen, we have many different ways to grow. You can improve as a specialist or a manager, and all your activities will be decently rewarded.
• Salary rate: EUR 4000 - 6500 per month (gross). Final compensation depends on experience and location and professional growth.

Locations

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Hungary, Italy, Latvia, Lithuania, Luxembourg, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, The Netherlands