Senior Cyber Threat Intelligence (CTI) Analyst

Position Overview
The Senior Cyber Threat Intelligence (CTI) Analyst will serve as a strategic force multiplier in protecting Client's infrastructure by identifying, analyzing, and contextualizing cyber threats before they materialize into operational impact. This role requires a forward-leaning, highly analytical professional who can synthesize technical indicators, adversary behaviors, and geopolitical developments into actionable intelligence that informs security operations and leadership decision-making across Client's transportation and enterprise environments.

The ideal candidate brings prior experience working within a Cyber Security Operations Center (CSOC), providing a strong foundation in security monitoring, incident escalation, and operational workflows. However, this position is intentionally designed as a progression beyond traditional SOC analyst responsibilities. Success in this role depends on the ability to move from reactive alert handling to proactive threat analysis, intelligence production, and strategic insight bridging the gap between real-time security operations and long-term threat awareness. The Senior CTI Analyst will partner closely with SOC, incident response, and engineering teams to ensure intelligence is relevant, timely, and operationally meaningful.

Key Responsibilities
Threat Intelligence Collection & Analysis
Gather, analyze, and correlate data from multiple sources (open-source, commercial feeds, ISACs, government advisories) to identify emerging threats.
Produce tactical, operational, and strategic intelligence reports for internal stakeholders.
Geopolitical & Regional Threat Monitoring
Track geopolitical events and conflicts that may impact critical transportation infrastructure.
Assess how global and regional developments influence cyber threat actors targeting North American transportation networks.
Critical Infrastructure Protection
Identify and assess threats specific to transportation systems, including rail, subway, and supporting operational technology (OT).
Collaborate with internal teams to provide intelligence-driven recommendations for risk mitigation.
Threat Actor Profiling & Campaign Tracking
Monitor and analyze activities of nation-state actors, cybercriminal groups, and hacktivists targeting transportation and critical infrastructure sectors.
Maintain profiles of adversaries, their tactics, techniques, and procedures (TTPs) aligned with MITRE ATT&CK framework.
Collaboration & Information Sharing
Engage with industry peers, ISACs, and government agencies to share intelligence and best practices.
Support incident response teams with contextual intelligence during active investigations.
Reporting & Briefing
Deliver timely intelligence briefings to leadership and operational teams.
Create dashboards and reports highlighting threat trends, vulnerabilities, and risk assessments.