Cyber Threat Intelligence Analyst — Protect & Detect

Introduction

At IBM, work is more than a job - it's a calling:
To detect. To protect. To contain. To collaborate. To prevent. To outthink threats. Not just to do something better, but to attempt what some would consider impossible. Are you ready to lead in this new era of technology and solve some of the world's most challenging problems? If so, let’s talk.

We are seeking an experienced Cyber Threat Intelligence (CTI) Analyst to join our team. As a CTI Analyst within the Office of the IBM CISO you will conduct all-source intelligence operations, which includes Gathering CTI that is relevant and actionable by IBM.

• Maintaining relevant, up-to-date and accurate data on threat activity clusters, nexuses, malware, tools, infrastructure, attack patterns and campaigns.
• Supporting other cyber defence teams such as Incident Response, Security / Network Operations Centres, Threat Hunting, Vulnerability Response and Engineering.
• Overall, your intelligence end products will be used to counter threats to IBM’s systems, networks, users and clients.
• The ideal candidate will understand the principles, processes and practices of CTI, have a strong analytical mindset and very good communication skills. This includes written report writing.
• A technical background in data manipulation (such as extract-transform-load, extract-load-transform), scripting or programming is desirable but not essential.

• Threat Intelligence:
  Collect, process, analyze and disseminate cyber threat intelligence from internal and external sources. Identify patterns and trends to anticipate, detect and mitigate potential threats.
• Perform contextualization on data and intelligence materials to determine their relevance and risk to IBM based on business operations, location, technology usage and victimology.
• Apply your skills to form hypotheses, critically assess and apply analysis techniques to query, merge, enrich, evaluate, and pivot within data to obtain and share insights with other IBM teams.
• Alert and Case Analysis:
  Analyze and investigate suspicious activities detected by our Security Operations Centre and Cyber Security Incident Response Team to assess the level of threat by correlating intelligence with sightings made within the IBM environment.
• Incident Response:
  Assist Incident Responders by enriching investigations, sightings and alerts with valid, qualified and contextualized intelligence. Vulnerability Assessment:
  Monitor for Proofs‑of‑Concept and exploitation of relevant vulnerabilities.
• Collaboration:
  
  CTI Analysts are expected to collaborate in virtual teams and across the CISO organization like SOC, Threat Hunting and CSIRT.

At times, they collaborate directly with other IBM functions—such as commercial business units, supply chain, and research—to model, contextualize, assess, detect, and help mitigate specific threats.

• Strong cyber security domain knowledge with the ability to speak authoritatively on cyber threat intelligence, including intelligence products (reports, advisories, indicators, attack/behaviour/compromise data) and intelligence lifecycle processes.
• Proven, methodical investigative approach with the ability to clearly articulate both findings and investigative methodology. Solid understanding of intelligence analysis principles, including deductive, inductive, and abductive reasoning.
• Practical experience with CTI standards and frameworks such as STIX/TAXII, CAPEC, the Cyber Kill Chain, and the CIA triad (or equivalents). Ability to model and analyze cyber threat Tactics, Techniques, and Procedures (TTPs), including decomposition of attack patterns.
• Hands‑on experience with the MITRE ATT&CK (Enterprise and Mobile) frameworks.
• Working knowledge of broader security standards such as CVE and CWE. Strong data handling and manipulation skills to support intelligence collection, processing, analysis, and dissemination (e.g., parsing, decoding, feature extraction).
• Experience with enterprise security tools, including Threat Intelligence Platforms (e.g., Threat Connect, OpenCTI), SIEM, SOAR, EDR, and data visualization tools (e.g., Kibana,…