Cyber Threat Intelligence Analyst

Altus Consulting; Herndon (VA); On-site; USD 120,000 - 150,000; Full time

Job summary

Altus Consulting is seeking skilled Cyber Threat Intelligence Analysts to support a mission-focused CSOC and CIRT within a highly secure customer environment. The role involves transforming security telemetry into intelligence to strengthen detection, incident response, and cyber defense decision-making.

Candidates should have hands-on ops experience, strong analytical skills, and the ability to bridge cybersecurity operations with threat intelligence.

Qualifications

• Active TS/SCI clearance with polygraph required
• 3–5+ years in SOC/Cyber Defense/IR environment
• Hands-on experience with SIEM, SOAR, IDS/IPS, network monitoring, endpoint security
• Experience with Splunk Enterprise Security, Elastic/ELK Stack, or comparable analytics platforms
• Experience conducting cyber threat analysis and producing actionable intelligence products
• Strong understanding of adversary TTPs
• Experience supporting incident response, cyber defense, or threat hunting activities
• Experience developing dashboards, reports, and security visualizations
• Experience writing technical documentation, SOPs, or playbooks
• Familiarity with cloud security monitoring in AWS, Azure, or GCP
• Experience in Intelligence Community/DoD/Federal cybersecurity environments

Responsibilities

• Analyze security data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint detection, and other cybersecurity platforms
• Identify, track, and assess adversary TTPs using MITRE ATT&CK
• Correlate threat intelligence with security events to improve detection, triage, threat hunting, and incident response activities
• Produce actionable intelligence reports, threat briefings, cyber situational awareness products, and adversary assessments for operational stakeholders
• Develop threat profiles and intelligence products that support security operations and cyber defense decision‑making
• Integrate cyber threat intelligence into daily SOC and incident response workflows
• Support incident investigations by providing contextual intelligence and adversary attribution where appropriate
• Collaborate with security engineers, analysts, responders, and leadership to operationalize cyber threat intelligence
• Identify intelligence gaps and recommend improvements to detection, monitoring, and response capabilities
• Develop executive and operational dashboards using Splunk, Elastic, or related analytics platforms
• Create visualizations that communicate emerging threats, attack trends, threat actor activity, and operational metrics
• Develop and maintain cyber defense playbooks, SOPs, and analytical methodologies
• Document threat hunting processes, incident response procedures, and CTI workflows
• Assist with automating intelligence collection, enrichment, analysis, and reporting activities
• Support continuous improvement initiatives that enhance cyber defense operations and mission effectiveness

Skills

Analytical thinking

Threat analysis

MITRE ATT&CK knowledge

Dashboard reporting

Threat hunting

Technical documentation

DevSecOps concepts

Automation scripting (Python/PowerShel

Cloud security monitoring (AWS/Azure/G

Detection engineering content

Strong communication

Translate findings to stakeholders

Government/federal experience

Tools

Splunk Enterprise Security

Elastic/ELK Stack

MISP

ThreatConnect

Anomali

Recorded Future

Job description

• Employment Type: Full Time
• Directorate: Cyber Security Engineering
• Location: Northern Virginia-Herndon/McLean
• Clearance: Active TS/SCI with Full Scope Polygraph Required
• Experience Level: Mid-Level, 3–5+ Years

Altus Consulting is seeking skilled Cyber Threat Intelligence Analysts to support a mission-focused Cyber Security Operations Center (CSOC) and Cyber Incident Response Team (CIRT) within a highly secure customer environment. The selected candidates will transform security telemetry and threat information into actionable intelligence that strengthens operational awareness, threat detection, incident response, and cyber defense decision‑making.

This position requires hands‑on security operations experience, exceptional analytical skills, and the ability to bridge the gap between cybersecurity operations and threat intelligence. The Cyber Threat Intelligence Analyst will analyze data from SIEM, SOAR, IDS/IPS, network monitoring, and endpoint security platforms, translating findings into actionable intelligence products, threat reporting, dashboards, playbooks, and operational procedures that improve cyber defense capabilities.

RESPONSIBILITIES

• Analyze security data from SIEM, SOAR, IDS/IPS, network monitoring, endpoint detection, and other cybersecurity platforms.
• Identify, track, and assess adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CK.
• Correlate threat intelligence with security events to improve detection, triage, threat hunting, and incident response activities.
• Produce actionable intelligence reports, threat briefings, cyber situational awareness products, and adversary assessments for operational stakeholders.
• Develop threat profiles and intelligence products that support security operations and cyber defense decision‑making.
• Integrate cyber threat intelligence into daily SOC and incident response workflows.
• Support incident investigations by providing contextual intelligence and adversary attribution where appropriate.
• Collaborate with security engineers, analysts, responders, and leadership to operationalize cyber threat intelligence.
• Identify intelligence gaps and recommend improvements to detection, monitoring, and response capabilities.
• Develop executive and operational dashboards using Splunk, Elastic, or related analytics platforms.
• Create visualizations that communicate emerging threats, attack trends, threat actor activity, and operational metrics.
• Develop and maintain cyber defense playbooks, standard operating procedures (SOPs), and analytical methodologies.
• Document threat hunting processes, incident response procedures, and CTI workflows.
• Assist with automating intelligence collection, enrichment, analysis, and reporting activities.
• Support continuous improvement initiatives that enhance cyber defense operations and mission effectiveness.

PREFERRED SKILLS

• Strong analytical, critical‑thinking, and problem‑solving abilities.
• Experience conducting cyber threat analysis and intelligence production.
• Knowledge of the MITRE ATT&CK framework and adversary TTP analysis.
• Experience developing dashboards, reports, and security visualizations.
• Experience supporting threat hunting, cyber defense, incident response, or security operations activities.
• Experience writing technical documentation, operational playbooks, and standard operating procedures.
• Familiarity with DevSecOps concepts and secure development practices.
• Experience with EDR/XDR technologies and threat intelligence platforms such as MISP, ThreatConnect, Anomali, or Recorded Future.
• Familiarity with Python, PowerShell, or other automation and scripting technologies.
• Experience with cloud security monitoring in AWS, Microsoft Azure, or Google Cloud environments.
• Experience developing security use cases, correlation rules, and detection engineering content.
• Strong written and verbal communication skills.
• Ability to communicate technical findings to both technical and non‑technical audiences.
• Experience supporting Intelligence Community, Department of Defense, or Federal cybersecurity environments.

BASIC QUALIFICATIONS

• Active TS/SCI clearance with Polygraph is required.
• Three to five or more years of experience supporting a Security Operations Center (SOC), Cyber Defense Team, Cyber Incident Response Team, or similar cybersecurity mission environment.
• Hands‑on experience with SIEM, SOAR, IDS/IPS, network monitoring, endpoint security, or related cybersecurity technologies.
• Experience working with Splunk Enterprise Security, Elastic/ELK Stack, or comparable cybersecurity analytics platforms.
• Experience conducting cyber threat analysis and producing actionable intelligence products.
• Strong understanding of adversary tactics, techniques, and procedures (TTPs).
• Experience supporting incident response, cyber defense, or threat hunting activities.
• Experience developing dashboards, reports, and security visualizations.
• Experience writing technical documentation, standard operating procedures, or operational playbooks.
• Strong written and verbal communication skills with the ability to communicate effectively across technical and non‑technical audiences.

PREFERRED CERTIFICATIONS

• GCTI (GIAC Cyber Threat Intelligence)
• CTIA (Certified Threat Intelligence Analyst)
• GCIH (GIAC Certified Incident Handler)
• GCFA (GIAC Certified Forensic Analyst)
• GCIA (GIAC Certified Intrusion Analyst)
• GCED (GIAC Certified Enterprise Defender)
• GMON (GIAC Continuous Monitoring)
• Splunk Enterprise Security Certified Admin
• Splunk Core Power User
• Elastic Certified Analyst
• Elastic Certified Engineer
• CISSP
• Security+
• CySA+

Why Join Altus?

At Altus, you'll work alongside highly skilled cybersecurity professionals supporting critical national security missions. We foster a collaborative environment focused on innovation, continuous learning, professional growth, and operational excellence. If you are passionate about cyber defense, threat intelligence, and protecting mission‑critical systems, we encourage you to apply.

The information provided in this job description is accurate and truthful to the best of our knowledge. However, it is not intended to be a contract, and we reserve the right to modify the job description at any time.

Altus Consulting is dedicated to diversity and inclusion, building a work environment where everyone feels respected and valued. We firmly believe in equal opportunity, guaranteeing fair and unbiased treatment for all individuals in all aspects of employment, regardless of race, color, religion, national origin, gender, sexual orientation, gender identity, pregnancy, childbirth or related medical conditions, age, protected veteran status, or disability status. We oppose discrimination in any form, and our commitment is evident in every interaction.