Senior Threat Intelligence Analyst

You’re the kind of person who sees a new threat campaign and immediately wants to know how it works, who it’s targeting, and what defenders can do about it.

You know strong threat intelligence is more than collecting indicators or summarizing external reports. It means connecting intelligence from multiple sources, understanding how threat actors operate, and turning that information into something useful for analysts, detection engineers, customers, and business leaders.

You enjoy digging into real incidents, identifying root causes and attacker behavior, and helping others understand what matters. You’re equally comfortable working through IOCs and TTPs with security practitioners or translating the same findings into clear guidance for a less technical audience.

At Expel, you’ll serve as a senior contributor and subject matter expert helping mature our threat intelligence capabilities. You’ll analyze threats observed across our Security Operations Center alongside external intelligence sources, help prioritize the intelligence that creates the greatest operational value, and partner with teams across the business to strengthen how we protect our customers.

• Give you direct exposure to real-world incidents and threat activity observed through our Managed Detection and Response service.
• Provide the opportunity to shape and mature Expel’s threat intelligence practices, tooling, and methodologies.
• Connect you with collaborative teams across the SOC, Threat Hunting, Detection Engineering, Product, Engineering, and Marketing.
• Give you a platform to share meaningful threat intelligence with customers, practitioners, and the broader security community.
• Surround you with curious security professionals who value thoughtful analysis, continuous learning, and practical outcomes.
• Give you the opportunity to mentor developing analysts and help raise the technical bar across the organization.

• Monitor and curate intelligence from open-source reporting, dark web communities, proprietary feeds, internal incidents, and other relevant sources.
• Evaluate threat intelligence for credibility, relevance, likelihood, and operational value before translating it into actionable guidance.
• Review security incidents identified through Expel’s MDR service to uncover root causes, attacker TTPs, and exploited vulnerabilities.
• Use internal incident data alongside external intelligence to identify emerging patterns and understand which threats are actively affecting customers.
• Produce clear threat intelligence reports containing IOCs, TTPs, potential impact, and recommended mitigation strategies.
• Communicate findings effectively to technical practitioners, customers, executive audiences, and cross-functional stakeholders.
• Keep Expel’s curated intelligence current by regularly processing internal incidents and external feeds through a Threat Intelligence Platform.
• Partner closely with SOC, Threat Hunting, and Detection Engineering teams to support the tactical application of intelligence.
• Research new technologies, techniques, and data sources that could strengthen Expel’s threat intelligence capabilities.
• Participate in intelligence-sharing communities and help build a positive reputation for Expel within the broader threat intelligence ecosystem.
• Support strategic customer conversations and inquiries involving advanced threats and emerging attacker behavior.
• Improve the processes, tools, and methodologies used to collect, assess, distribute, and operationalize threat intelligence.
• Mentor junior and staff-level colleagues while serving as a trusted subject matter expert during complex incident reviews.

• Approximately 5 to 8 years of professional experience across threat intelligence, security operations, incident response, detection engineering, or a closely related discipline.
• A strong understanding of common cyberattack vectors and the tools, techniques, and procedures used by threat actors.
• Experience performing detailed incident reviews to identify root causes, exploited vulnerabilities, and attacker behavior.
• The ability to evaluate intelligence from multiple…