Threat Intelligence Analyst

Blackthorne Consulting; Oregon; Hybrid; USD 110,000 - 160,000; Full time

Job summary

Blackthorne Consulting seeks Threat Intelligence Analysts/Engineers to collect data, research threats, analyze and deliver insights for enterprise detection and response. Role blends scripting, automation, and threat analysis with security engineering to create scalable intelligence inputs.

Responsibilities include researching adversary campaigns, building automation pipelines, and delivering client-focused threat intelligence reports and briefings.

Qualifications

• 4+ years in threat intelligence or related security field.
• Ability to translate threat intel into actionable detections.
• Experience writing analysis scripts or automation tools.
• Experience with sandboxing technologies and malware analysis.

Responsibilities

• Conduct threat intelligence research tracking adversary groups and campaigns.
• Develop automation to collect, normalize, and enrich intel data.
• Deliver intelligence insights to clients and security teams.
• Produce technical threat reports and campaign analyses.

Skills

Threat intelligence research

Automation scripting

Threat analysis

Open-source threat data

Adversary emulation

Tools

Sandboxing technology

Threat intelligence platforms (MISP/OpenCTI)

Job description

Threat Intelligence Analysts / Engineers are responsible for collecting data, researching threats, analyzing data, and creating actionable insights for key stakeholders to improve enterprise detection, response, and risk awareness.

This role combines deep technical skills (scripting, sandboxing, automation) with threat analysis with operational security engineering insight. Analysts identify collection opportunities, track adversary activity, and investigate campaigns while creating the scripts and tooling to deliver at scale.Threat Intelligence Engineers work closely to provide actionable inputs for Blackthorne’s detection engineering, threat hunt, and adversary emulation teams to ensure that intelligence directly improves defensive capabilities.Blackthorne is a mission-focused consulting organization, and we hire professionals who combine strong technical expertise with accountability, collaboration, and a commitment to measurable Client outcomes.

Conduct Threat Intelligence Research

Track adversary groups and campaigns relevant to enterprise environments. Identify and exploit data collection opportunities. Analyze emerging threat techniques, malware families, and attack infrastructure. Build automation to drive analysis at scale. Perform in-depth, high interaction analysis of phishing campaigns, command-and-control infrastructure, and attacker tooling.

Build Intelligence Engineering Capabilities

Develop automation pipelines to collect, normalize, and enrich threat intelligence data. Maintain internal intelligence repositories and campaign tracking systems. Build and maintain basic APIs to integrate with enterprise security platforms where possible. Evaluate threat intel feeds and data sources for critical features such as timeliness, reliability, and relevancy.

Deliver Intelligence Insights to Clients

Produce threat intelligence reports and campaign analyses. Deliver technical briefings to security teams and executive stakeholders. Support incident investigations by providing adversary context and attribution insights. Assess any existing or desired client threat intel functions and develop actionable requirements through roadmaps to improve client maturity.

Key Deliverables

• Threat actor profiles and campaign analyses
• Intelligence automation pipelines
• Client threat briefings
• Assessments of client threat intel capabilities

Success is measured through improvements in detection coverage, faster incident response, and actionable intelligence adoption by Clients.

RequirementsMinimum Qualifications

• 4+ years experience in threat intelligence
• 2+ years experience writing analysis scripts or other applicable automation
• 2+ years experience with sandboxes and sandboxing technology
• 2+ years experience tracking criminal threat actors
• Experience analyzing adversary tactics and campaigns
• Familiarity with enterprise attack techniques
• Experience producing technical intelligence reports
• Ability to translate threat intel insights into actionable threat detection, threat hunt, or other control recommendations

Preferred Qualifications

• 2+ years experience working as a threat intelligence analyst in a professional organization
• Demonstrated track record of open source contributions or conference talks related to automated analysis of threat data, sandboxing or other related topics
• Malware analysis experience (including experience writing and maintaining Yara signatures)
• Experience tracking nation-state actors
• Experience with threat intelligence platforms (MISP, OpenCTI, etc.)
• Python or other scripting experience