Intelligence Lead Analyst - OSINT Threat

Overview

Go beyond traditional analysis and become a proactive threat hunter at the heart of Citi's global security operations. The CSIS Advanced Analytics and Cyber OSINT program seeks a senior Intelligence Lead Analyst to design, lead, and mature our threat hunting capabilities. In this pivotal role, you will transform open-source information into actionable intelligence, safeguarding the assets, integrity, and reputation of Citi and its clients against emerging threats.

Citi Security and Investigative Services is a full-service security and investigative team that protects the assets, integrity, and reputation of Citi and its clients as the industry-leading provider of security, investigations, and intelligence. The CSIS Advanced Analytics and Cyber OSINT program delivers timely, actionable intelligence to Citi stakeholders through collection and analysis using both open-source and internal data sources, supporting complex financial crime investigations, cyber-enabled fraud matters, and high-risk security events.

The program drives efficiencies through the creation, integration, and deployment of custom analytical tools and intelligence capabilities into the hands of analysts and investigators across the enterprise.

The Intelligence Lead Analyst (Open Source Intelligence - Threat Hunting) is a senior-level intelligence analyst position responsible for designing, leading, and maturing Citi's proactive threat hunting and cyber Open Source Intelligence (OSINT) capabilities. The role goes beyond reactive analysis: the incumbent will drive hypothesis-driven hunt operations across Citi's global enterprise environment, operationalize cyber threat intelligence into detection engineering, and serve as a subject matter expert on adversary tradecraft, tactics, techniques, and procedures (TTPs), and emerging threat actor campaigns targeting the financial sector.

The role requires deep expertise in the cyber threat intelligence lifecycle, adversary emulation, and the ability to translate complex intelligence into actionable outcomes for Investigations, Security, and other stakeholders.

• Analyze regional threat data and determine a correlation, if any, to existing intelligence requirements
• Monitor and research cyber threats with a direct or indirect impact to the Citi brand
• Research and identify malicious activity by performing post‑mortem analysis on logs, traffic flows, and other activities
• Conduct intrusion analyses to ascertain the impact of an attack, and develop mitigation techniques for future attacks
• Evaluate networks and programs to assess potential weaknesses and points of entry
• Analyze and present to senior leadership discovered patterns to forecast future cyber‑attacks and their potential impact
• Liaise with intelligence communities, law enforcement, industry partners, peer financial institutions, and information sharing communities
• Triage, process, analyze, and disseminate intelligence alerts, reports, and briefings
• Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency

• 6‑10 years of relevant experience
• Working knowledge in one or more of the following areas:
  Advanced Persistent Threat, Third Party Risks/Threats, Cybercrime, Extremist Groups and Cyber Terrorists, Hacktivism, Distributed Denial of Service attacks, Fraud, Malware, Mobile Threats
• Proven track record of operationalizing cyber threat intelligence — translating raw intelligence into detections, hunt packages, and risk‑relevant reporting
• Consistently demonstrates clear and concise written and verbal communication
• Proven influencing and relationship management skills
• Proven analytical skills

• Bachelor’s degree/University degree or equivalent experience
• Master’s degree preferred (Advanced degree preferred,…