CSIS Intelligence Lead Analyst - Advanced Analytics and Cyber OSINT

Citigroup Inc.; Charlotte (NC); On-site; USD 130,000 - 170,000; Full time

Job summary

Citigroup Inc. in its CSIS unit seeks an Intelligence Lead Analyst to own and enhance link analysis frameworks and to engineer in-house tools that automate intelligence collection at scale.

This senior role centers on Cyber OSINT mastery and technical innovation, combining intelligence analysis with software development to detect and neutralize threats across Citi’s global operations. You will collaborate with developers, investigators, and external partners, mentoring junior staff and

Qualifications

• 6–10 years of relevant experience.
• Working knowledge in one or more areas: Advanced Persistent Threat.

Responsibilities

• Fulfill cyber OSINT requests by applying advanced analysis tools and techniques to surface timely, actionable intelligence.
• Proactively anticipate gaps in our intelligence posture and develop innovative solutions, collaborating with internal and external stakeholders on open-source methodologies and tooling.
• Design (develop), implement, and maintain in-house solutions for collecting, processing, and analyzing open source data.
• Automate intelligence collection capabilities, leveraging existing link analysis frameworks and actively identifying and evaluating alternative solution providers.
• Apply in-depth disciplinary knowledge to triage, process, and analyze intelligence alerts, reports, and briefings.
• Engage in liaison activities with developers, intelligence communities, law enforcement, industry partners, peer financial institutions, and information sharing communities.
• Manage multiple projects simultaneously with a proactive, self-motivated approach, ensuring timely delivery of high-quality results while collaborating effectively with global teams.
• Complete the daily operational components of the intelligence mission.
• Assume an informal/formal mentor role within teams and assist with the coaching and training of new team members.

Skills

Cyber OSINT mastery

Link analysis

Tools

Link analysis frameworks

Job description

We're looking for a sharp, drivenIntelligence Lead Analystto join a team that doesn't just analyze intelligence — it builds the tools that collect it.

In this senior-level role, you'll take ownership of maintaining and enhancing our link analysis frameworks while engineering in-house solutions to automate intelligence collection at scale. Your work will directly shape how we identify, pursue, and neutralize threats across one of the world's largest financial institutions.

This role is fundamentally about two things: CyberOSINT masteryandtechnical innovation. If you thrive at the intersection of intelligence analysis and software development, this is your opportunity.

CSIS Intelligence Advanced Analytics and Cyber OSINT — Program Description

Citi Security and Investigative Services (CSIS) is a full-service security and investigative team that protects the assets, integrity, and reputation of Citi and its clients as the industry-leading provider of security, investigations, and intelligence. The CSIS Advanced Analytics and Cyber OSINT program delivers timely, actionable intelligence to Citi stakeholders through collection and analysis using both open-source and internal data sources, supporting complex financial crime investigations, cyber-enabled fraud matters, and high-risk security events. The program drives efficiencies through the creation, integration, and deployment of custom analytical tools and intelligence capabilities into the hands of analysts and investigators across the enterprise.

Job Description

The Intelligence Senior Analyst is an senior-level position responsible for collection/analysis of IoCs and TTPs, maintaining and updating existing link analysis frameworks while also developing in-house solutions to automate intelligence collection. The primary objective of this role is to leverage Open Source Intelligence (OSINT) and development skills to build and operate advanced intelligence capabilities. While familiarity with the cyber domain is welcome, the core focus is on OSINT analysis and the creation of automated collection tools.

Responsibilities

• Fulfill cyber OSINT requests by applying advanced analysis tools and techniques to surface timely, actionable intelligence.
• Proactively anticipate gaps in our intelligence posture and develop innovative solutions, collaborating with internal and external stakeholders on open-source methodologies and tooling.
• Design (develop), implement, and maintain in-house solutions for collecting, processing, and analyzing open source data.
• Automate intelligence collection capabilities, leveraging existing link analysis frameworks and actively identifying and evaluating alternative solution providers.
• Apply in-depth disciplinary knowledge to triage, process, and analyze intelligence alerts, reports, and briefings.
• Engage in liaison activities with developers, intelligence communities, law enforcement, industry partners, peer financial institutions, and information sharing communities.
• Manage multiple projects simultaneously with a proactive, self-motivated approach, ensuring timely delivery of high-quality results while collaborating effectively with global teams.
• Complete the daily operational components of the intelligence mission.
• Assume an informal/formal mentor role within teams and assist with the coaching and training of new team members.

Qualifications

• 6-10 years of relevant experience
• Should have a working knowledge in one or more of the following areas: Advanced Persistent Threat