Description:

TIAA - Cyber Threat Intelligence Engineer

Job Profile Summary
The Cyber Threat Intelligence (CTI) Analyst is a technically driven security professional responsible for identifying, analyzing, and communicating actionable intelligence on emerging and active threats targeting the organization.
This individual serves as a critical link between raw threat data and meaningful defensive action, translating complex adversarial behavior into prioritized, operationally relevant guidance for security teams.
The ideal candidate brings deep, hands-on experience across the full threat intelligence lifecycle - from data collection and source management through analysis, dissemination, and response.

Critically, this role requires demonstrated proficiency not only in consuming intelligence, but in building and tuning alerting pipelines that convert threat indicators and behavioral patterns into detection logic within security platforms.
The analyst must be equally comfortable writing a structured intelligence report and diving into a SIEM to validate or refine an alert rule.
This is not a passive research role.
The CTI Analyst is expected to actively hunt, investigate, and collaborate with Security Operations, Incident Response, and Vulnerability Management teams to ensure intelligence drives real-world risk reduction.

Position Overview
The Cyber Threat Intelligence Analyst is responsible for delivering timely, accurate, and operationally relevant intelligence to protect the organization's people, data, and systems.
This professional collects and analyzes threat data from internal telemetry, open-source intelligence (OSINT), commercial feeds, and trusted partner communities to identify threat actors, campaigns, vulnerabilities, and attack techniques relevant to the enterprise setting.
A defining expectation of this role is the ability to operationalize intelligence directly - building detection content, creating and managing alerts, and supporting response activities when threats materialize.




The analyst must have practical experience with industry-standard CTI platforms and security tooling, and must be able to move fluidly between strategic analysis and tactical, hands-on work.

Key Responsibilities
The CTI Analyst will collect, process, and analyze threat intelligence from a broad range of sources including commercial threat intelligence platforms, ISAC/ISAO feeds, government advisories (CISA, FBI, etc.), dark web monitoring, and internal security telemetry.
The analyst will assess the relevance, credibility, and severity of identified threats and translate findings into clear, concise intelligence products tailored to technical and non-technical audiences alike.
A core function of this role is the design, creation, and ongoing management of threat-based alerting. Cyber Threat Intelligence Engineer

Job Description
The analyst will develop detection rules, correlation logic, and automated alerts within SIEM, SOAR, EDR, and threat intelligence platforms based on indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and adversary behavioral patterns mapped to the MITRE ATT&CK; framework.
The analyst will continuously tune existing alerts to reduce false positives, improve fidelity, and ensure detection coverage evolves with the threat landscape.
The analyst will actively monitor alert queues and triage incoming threat notifications, determining disposition and escalation paths in coordination with the Security Operations Center (SOC) and Incident Response teams.
During active security incidents, the analyst will provide real-time intelligence support - enriching artifacts, profiling threat actors, and advising on adversary behavior and likely next steps.
Additionally,



the analyst will maintain the organization's threat intelligence platform (TIP), ensuring indicators are ingested, tagged, enriched, and retired appropriately based on confidence and expiration.
The analyst will support threat hunting initiatives by developing hypotheses grounded in current intelligence and collaborating with detection engineers to mature the organization's overall detection posture.
Regular deliverables include threat briefings, finished intelligence reports, IOC packages, and executive level threat summaries.
The analyst will also participate in intelligence sharing with external partners and peer organizations
through established trust groups and platforms.

Required Qualifications
The successful candidate will bring a minimum of three to five years of hands-on experience in cyber threat intelligence, security operations, or a closely related discipline.
Demonstrated, practical experience with threat intelligence platforms such as Anomali Threat Stream, Recorded Future, MISP, Threat Connect, or similar tools is required.
The candidate must have proven experience creating and managing alerting content within enterprise
security platforms, including at least one major SIEM solution such as Splunk, Microsoft Sentinel, IBM QRadar, or Chronicle.
A strong working knowledge of the MITRE ATT&CK; framework is essential, including the ability to map observed adversary behavior to specific techniques and use that mapping to inform detection strategy.
The candidate should be proficient in threat indicator analysis and understand the nuances of indicator confidence, decay, and contextual enrichment.
Familiarity with STIX/TAXII standards for structured threat intelligence sharing is expected.
The analyst must possess strong analytical and written communication skills, with the ability to produce clear, well-structured intelligence products for both technical practitioners and senior leadership.
Experience supporting or participating in incident response engagements from an intelligence perspective is strongly preferred.

📌 CYBESEC_Engineer Cyber Threat Intelligence (CTI) (India)
🏢 TRIGENT SOFTWARE PRIVATE
📍 India