Senior Cyber Intelligence Analyst

If you are motivated and believe in the credit union philosophy of “People Helping People,” join our team!

The Senior Cyber Intelligence Analyst is the technical lead for intelligence-driven detection and exposure management. You own the analytic tradecraft, the detection engineering standards, and the intelligence products that shape how the organization prioritizes vulnerabilities, builds detections, and briefs leadership. You set the bar for the team’s Splunk work, mentor analysts, and represent threat intelligence to peer teams and executives.

This is a senior individual-contributor role with real ownership. You are expected to define how the work gets done, not just do it, and to make defensible analytic calls that leadership will act on.

Lead threat intelligence and analysis

• Own the intelligence requirements process: define priority intelligence requirements with stakeholders, maintain the collection plan, and evaluate feed and vendor value.
• Lead analysis of threat actors, campaigns, malware families, and TTPs relevant to financial services, our technology stack, and our third-party ecosystem, mapped to MITRE ATT&CK.
• Produce and quality-review decision-ready intelligence products at the tactical, operational, and strategic levels, including briefings for the CISO and contributions to governance and Board-level reporting.
• Own the threat-informed assessment of newly disclosed vulnerabilities (CISA KEV, EPSS, exploit availability, vendor advisories) and drive that assessment into vulnerability prioritization and emergency remediation decisions.
• Lead intelligence support to incident response: attribution, campaign context, indicator enrichment, and post-incident lessons that become detections and requirements.
• Represent the organization in industry sharing communities (FS-ISAC and peer groups) and build relationships with vendor and government intelligence contacts.

Lead detection engineering

• Own the detection engineering program in Splunk Enterprise Security: standards, lifecycle, coverage measurement, and the tuning process.
• Design and build high-value detections, correlation searches, and risk-based alerting (RBA) logic; review and mentor others’ detection work.
• Maintain the MITRE ATT&CK coverage map, prioritize gaps against current threat intelligence and crown-jewel assets, and drive a roadmap to close them.
• Establish detection-as-code practices: version control, peer review, testing against replayed or emulated attack data, and controlled deployment.
• Lead purple-team and adversary emulation exercises to validate detections and measure real coverage rather than assumed coverage.
• Set standards for SPL quality, data model use, CIM compliance, and search performance; partner with the Splunk platform team on data onboarding and platform direction.

Lead threat hunting and exposure management

• Design and run the threat hunting program: hunt hypotheses tied to priority intelligence requirements, documented methodology, and outcomes that feed detections and remediation.
• Lead cross-source analysis correlating vulnerability data (Tenable) with endpoint (Sentinel One), source control (Git Hub), network and edge (F5, Check Point, Zscaler), and email (Proofpoint) telemetry to identify exposed, exploitable, and actively targeted assets.
• Serve as the threat intelligence lead for the continuous threat exposure management (CTEM) program, ensuring exposure prioritization reflects real adversary behavior and business impact.
• Provide threat research and detection strategy for emerging programs in AI security, software supply chain and third-party risk, and application security.

Mentor, influence, and report

• Mentor and technically guide analysts on the team; review analytic products and…