Analyst, Cyber Threat Intelligence

S-Rm; Gauteng; Hybrid; ZAR 30 000 - 50 000; Full time

Job summary

A leading global consultancy in Gauteng is seeking a Cyber Threat Intelligence Analyst. In this role, you'll track cyber threats, analyze incident data, and assist in recovering from security incidents. Ideal candidates will possess strong analytical skills and a keen interest in cyber threats. The company values work-life balance with flexible working arrangements and offers comprehensive benefits, including health support and parental leave. Join a dynamic team at the forefront of cybersecurity innovation.

Benefits

23 days holiday per year increasing to 28

Hybrid working options

Private pension contributions

Life insurance coverage

Qualifications

• Must produce clear and concise reports.
• Ability to work with incomplete or conflicting information.
• Interest in financially motivated cyber activity.

Responsibilities

• Track developments in ransomware and cybercrime.
• Monitor leak sites and inform case leads.
• Analyze incident data for accurate reporting.
• Conduct research for in-depth investigations.

Skills

Excellent written and verbal communication skills

Strong analytical and problem-solving skills

Understanding of foundational cyber concepts

Demonstrated interest in cyber threats

Education

Degree in Cybersecurity, Computer Science, or related field

Tools

Threat Intelligence platforms

OSINT tools

Job description

Overview

S-RM is a global intelligence and cyber security consultancy.

Since , we've helped some of the most demanding clients in the world solve some of their toughest information security challenges.

We've been able to do this because of our outstanding people.

We're committed to developing sharp, curious, driven individuals who want to think critically, solve complex problems, and achieve success.

But we also know that work isn't everything.

It's about the lives and careers it helps us build.

We're immensely proud of this culture and we invest in our people's wellbeing, learning, and ideas every day.

We're excited you're thinking about joining us.

Working in Cyber at S-RM

Our Cyber Security division is the fastest-growing part of S-RM.

The cyber sector is always evolving, and our Incident Response and Managed Services practices are in more demand than ever.

We're building a team to meet this challenge.

We're quick to respond, innovate, and improve.

We don't get too hung up on hierarchy or bureaucracy.

If your ideas are good enough, we'll empower you to implement them.

If you're the best person to talk to a customer, you'll get that opportunity, regardless of the title in your email signature.

And when you need a hand, your team will always have your back.

We also don't believe there's a typical cyber security professional.

We've built a team of intelligence analysts, technical specialists, software developers, investigators, risk managers, and more.

You’ll always find a range of perspectives and expertise to help you learn and grow.

If that sounds like your kind of team, we'd like to hear from you.

The role

Cyber Threat Intelligence (CTI) is an integral part of our Incident Response (IR) and Managed Services practices.

As a CTI analyst you will be a critical part of our wider cyber team's success.

You will work across the full intelligence cycle to help our clients respond and recover to security incidents, and stay ahead of evolving threats, including:

• Threat Actor Intelligence: track developments in the ransomware and cybercrime ecosystem, write and update profiles on key threat actors of interest, shared with clients to inform case strategy and externally as thought leadership.


• Threat Actor Engagement: monitor leak sites and negotiation portals across our global IR cases, inform case leads of regular developments.


• Research and drafting attestations on sanctions exposure for given threat actors.


• Dark Web Monitoring: use threat intelligence platforms and specialist tools to conduct targeted research on the dark web and set up and deliver regular monitoring engagements.


• Assist with renewals of these cases.


• Technical IOC Management: collate technical indicators of compromise (IOCs) from across our global IR team, ensure these are enriched and correctly classified, and facilitate dissemination across the organisation.


• Incident Data Collection and Analysis: help ensure that incident data collected by our global IR team from our engagements is accurate and consistent; assist with the management of this dataset and produce regular reporting on trends and insights.


• CTI-lead analysis: assist with in-depth investigations with a strong threat intelligence component, including conducting research and drafting client-facing reports.


• Blockchain analysis: use specialist tools to trace ransom payments to identify sanctions exposure or other compliance risks, and draft reports to present findings to clients.


• Thought leadership: contribute to public write-ups and presentations on new vulnerabilities, trends, and threat actor techniques.

Help develop and share domain expertise: We will support you in growing your cyber expertise, including sharing it with the wider team through internal initiatives and programs.

Help contribute to business development: You will help cultivate and manage close relationships with external partners who we share intelligence with and help identify business development opportunities.

Other features of the role include

Variety of casework: no day will be the same.

Our team responds to a huge variety of incidents for both public and corporate clients.

Range of opportunities: you will have opportunities to broaden your security awareness into testing and advisory projects, in addition to deepening your cyber threat intelligence and incident response expertise.

Flexible working practices: responding to incidents can be intense, high‑pressure work.

We are mindful of our team's work/life balance and offer flexible working options to support your wellbeing.

What we’re looking for

Candidates with the following qualifications and experience are likely to succeed as Cyber Threat Intelligence Analysts at S‑RM.

That said, if you don't think you meet all of the criteria below but still are interested in the job, please apply.

We nurture a culture of equality, diversity and inclusion and we are dedicated to developing a workforce that displays a variety of talents, experiences and perspectives.

Required Skills

• Excellent written and verbal communication skills, with the ability to produce clear and concise reports.


• Strong analytical and problem‑solving skills, including the ability to work with incomplete, ambiguous, or conflicting information.


• Understanding of foundational cyber concepts, such as common attack vectors (e.g., phishing, credential misuse), high‑level security terminology, and general threat actor motivations.


• Understanding of core intelligence concepts, including the intelligence lifecycle, requirements gathering, and the distinction between tactical, operational, and strategic intelligence outputs.


• A demonstrated interest in cyber threats, including financially‑motivated activity such as ransomware and extortion.

Preferred Skills

• Academic or professional background in a research‑focused discipline (qualitative or quantitative), such as Political Science, Intelligence Studies, Criminology, Cybersecurity, Computer Science, Data Science, or related fields.


• Familiarity with cybersecurity fundamentals, such as threat actor TTPs, IOCs, and relevant frameworks (e.g., MITRE ATT&CK).


• Ability to contextualize findings into business‑relevant assessments, including potential impact, likelihood and recommended mitigations.


• Experience using OSINT and / or Threat Intelligence platforms (e.g. VirusTotal, Shodan, MISP, Recorded Future).

Personal attributes

• An investigative mindset and an enthusiasm for investigations.


• Exceptional attention to detail, especially when examining indicators, infrastructure data, and adversary behaviours.


• A collaborative mindset and willingness to collaborate across teams.


• Ability to thrive under pressure, prioritize multiple tasks, and meet short deadlines.


• A self‑starter, demonstrating initiative, ownership of work and the ability to identify opportunities to enhance S‑RM's cyber capabilities.

Relevant industry certifications are not required for this role.

However, holding relevant CTI or cyber security related certifications such as the following is beneficial: GCTI, GCFA, SSCP, or Security+.

Benefits

We offer thoughtful, balanced rewards and support to help our people do their best work and live their lives outside of work.

This includes but is not exhaustive of

• Holiday – 23 days per year increasing to 28 days (day for every year you worked at S‑RM, up to a maximum of 5 days) in addition to bank holidays.

• Gap Cover policy – allowing you to bridge the gap between your medical bills and your medical aid cover.

• Hybrid working and flexible working hours;


• Private pension – up to 7% contribution matched by the company;


• Life Insurance 4X annual salary.

Parental Support

• Fertility treatment leave – 5 days of leave per cycle of treatment per year.


• Maternity leave – 26 weeks of full pay followed by 13 weeks of half pay.


• Paternity leave – 6 weeks of full pay.

Various Health and Medical Benefits including

• Medical aid with Discovery Health for employee, partner, and children up to the cost of the Classic Saver plan (taxable benefit) for you and your family.


• EAP programme for you and your immediate family.


• Free access to the world‑famous mindfulness app Headspace.

The application process

We want to get to know you, and for you to get to know us, to see if we'd be a good fit.

We are responsive and respectful of people's time throughout our hiring process.

A typical application process includes:

• Initial screening of your application by our recruiting team.


• An interview to assess your baseline technical skills.


• An interview to discuss your previous experience, broader competencies, and suitability for the role.

Interested in building your career at S‑RM? Get future opportunities sent straight to your email.

Accepted file types

pdf, doc, docx, txt, rtf.