Threat Intelligence Specialist

• Monitor and analyze global geopolitical events, emerging security threats, and assigned topical or regional portfolios
• Manage rotating intelligence accounts and develop subject matter expertise across threat vectors
• Draft and present tactical flash alerts, strategic assessments, and threat horizon forecasts
• Leverage OSINT, specialized threat platforms, and internal data sets to identify indicators of physical security, operational, geopolitical, or reputational risk
• Provide analytical support to the Resiliency Center’s 24/7 watch desk and incident management teams during global crises or threat escalations
• Partner with legal, human resources, cybersecurity, and regional security teams
• Perform other duties as assigned based on evolving company needs

Intelligence Analyst

• Lead open source analysis for CSIS investigations involving fraud, cyber, insider, and other security threats
• Monitor threats and collect data from social media, the deep web, and the dark web using advanced techniques
• Apply qualitative and quantitative analytical methodologies, including link analysis and digital footprint analysis
• Identify intelligence gaps and develop innovative solutions
• Partner with internal and external stakeholders on open source methodologies and tools
• Deliver concise written intelligence products and oral briefings
• Manage multiple projects simultaneously and ensure timely delivery of high-quality results
• Collaborate with global teams

Senior Intelligence Analyst

• Monitor and synthesize internal and external intelligence to identify emerging rewards-abuse schemes
• Conduct qualitative and quantitative analysis to evaluate risk indicators, summarize patterns, and identify trends affecting Citi’s rewards ecosystem
• Assess at-risk accounts and behaviors, identify potential abuse signals, and document findings for internal partners
• Serve as liaison between the Fraud Fusion Center and industry working groups
• Participate in external fraud/loyalty-abuse roundtables and information-sharing forums
• Collaborate with Fraud Policy & Strategy, Product Teams, Data Analytics, AML, Citi Security & Investigative Services, and other stakeholders
• Share emerging intelligence, coordinate assessments, drive threat awareness, and support mitigation steps
• Document processes, investigative flows, and escalation pathways for rewards-abuse incidents
• Maintain investigative notes, intelligence summaries, and analytical artifacts in case-management systems
• Support development of playbooks, best practices, and process improvements
• Balance day-to-day investigations with longer-term research initiatives
• Prioritize assignments, escalate urgent issues, and assist with crisis-response workflows

• Work closely with commercial teams to develop trading strategies and identify key market drivers
• Develop and maintain proprietary outlooks on commodity and consumer markets relevant to petrochemicals production, trade, and consumption
• Respond to trading teams’ market questions and prepare presentations for events
• Conduct research to support approval of large transactions and trading strategies
• Develop fundamental supply and demand analyses for commodity markets at regional and global levels
• Create analyses and reports covering price trends, spreads, margins, supply chain costs, and other market indicators
• Contribute to recurring market intelligence reports and dashboards
• Communicate with suppliers, customers, and service providers to gather market insights
• Share findings with Tricon’s trading teams as part of the in-house market intelligence function
• Identify emerging trends, data gaps, and areas requiring further analysis
• Develop research initiatives that provide actionable insights across regions and products
• Recommend tools, data sources, and research methods to improve market insights
• Enhance data pipelines, custom models, and the use of alternative data
• Evaluate contractual trade structures, including pricing mechanisms, points of exposure, and opportunities to capture value

Market Intelligence Analyst

• Lead and execute complex, high-priority threat-hunting missions using threat intelligence, multi-source telemetry, and adversary behavior analysis
• Architect and execute sophisticated threat-hunting strategies
• Identify anomalous behavior, insider risks, advanced persistent threats, and unknown threats
• Analyze adversary Tactics, Techniques, and Procedures using the MITRE ATT&CK framework
• Translate findings into proactive defense strategies and novel detection logic
• Provide technical direction and investigative leadership during major cybersecurity incidents and high-risk investigations
• Mentor and direct senior threat hunters and junior staff
• Synthesize investigative findings and threat telemetry into strategic summaries and operational metrics for executive leadership and stakeholders
• Mature hunting methodologies, detection capabilities, and automated workflows across SIEM, EDR, and data lake platforms
• Partner with Threat Intelligence, Incident Response, SOC, and Security Engineering teams on detection, response, and remediation
• Develop custom detection rules using YARA, SIGMA, KQL, and AQL
• Develop network- and host-based Indicators of Compromise and Indicators of Attack
• Maintain operational readiness for urgent security events or critical incidents off-hours as needed
• Brief executive leadership on threat landscapes and high-priority investigations

Distinguished Threat Hunter

• Produce investigative intelligence and insider threat analyses
• Conduct comprehensive post-investigation analysis to identify root causes, systemic gaps, and lessons learned
• Integrate analytical findings into preventive controls, program enhancements, and long-term mitigation strategies
• Understand insider risk taxonomies and changes to the threat landscape from emerging technologies, geopolitical and sociopolitical factors, and organizational changes
• Support development of a program driving prevention, detection, and remediation of insider threats
• Communicate findings and recommendations to internal stakeholders
• Participate in industry groups and benchmarking activities to facilitate information-sharing and build a dynamic and agile program

Lead Intelligence Analyst

• Pivot from scam domains, IPs, or certificates across shared certificates, registrars, nameservers, hosting, and ASNs to map scam infrastructure
• Track scam campaigns through new domains, hosting and registrar changes, certificate reuse, takedowns, and seizures
• Drive threat actor attribution using open-source and commercially available data
• Fuse technical infrastructure intelligence with on-chain data from wallets through laundering paths and cash-out points
• Build clustering logic, detection rules, automation, and tooling to proactively identify malicious infrastructure
• Produce calibrated, defensible assessments and determine malicious-versus-benign activity
• Synthesize OSINT, technical, financial, on-chain, and off-chain intelligence into actionable targeting packages
• Own the intelligence cycle end to end with minimal supervision
• Partner with the Scams SME team, data, engineering, product, analysts, and government or law-enforcement partners
• Participate in weekly team syncs and daily async standups
• Document output in Notion and TRM investigative tools
• Support time-sensitive disruption windows

Cyber Threat Intelligence Analyst, Scams

• Research, author, and publish intelligence products on environmental crime and illicit finance
• Maintain a reusable environmental-crimes threat picture inside TRM's intelligence infrastructure
• Use on-chain, OSINT, and partner-provided off-chain data to identify wallets, entities, and off-ramps behind environmental crime networks
• Produce structured, source-cited targeting packages supporting law-enforcement and partner investigations
• Own and manage the United for Wildlife and Project Pangolin partner program across 200+ organizations
• Provide case assistance, analysis, guidance, training, and onboarding to partners
• Organize cross-sector and cross-border sprints and working groups aimed at real-time disruption
• Collaborate with USFWS, HSI, DOJ, Interpol, UNODC, national agencies, and NGOs
• Brief internal stakeholders, partners, and leadership and represent TRM with media and at external events
• Shape TRM's mission tooling by translating field needs into product feedback and prototypes
• Build reusable AI workflows for signal processing, target selection, and drafting with human validation
• Deliver an active case and finished intelligence product within 30 days
• Deliver intelligence or training to a United for Wildlife partner and ship a reusable AI workflow within 60 days
• Establish a repeatable partner-delivery program and publish or brief an intelligence product within 90 days

Senior / Staff Intelligence Analyst, Environmental Crimes

• Support operations at the Navy Warfare Development Center on Norfolk Naval Station
• Provide analytical expertise to the Maritime Operations Center – Exercise Support Team and partner facilities across Hampton Roads
• Research and analyze current and emerging ISR systems and TTPs
• Ensure accurate portrayal of friendly and adversary capabilities and realistic stimulation of intelligence and C2 systems
• Identify gaps between simulation capabilities and OLW intelligence training stimulation requirements
• Maintain a comprehensive list of requirements and coordinate with Technical Leads and the Site Manager to forward requirements to NCTE Software Development
• Provide intelligence dissemination matrices for each exercise event
• Maintain knowledge of intelligence simulations within the JLVC federation
• Research emerging friendly and enemy ISR capabilities for future exercises
• Serve as primary POC to the Intelligence community and designated working groups
• Assist with planning, design, and execution of Operational-level Fleet Synthetic Training events
• Support on-site and distributed training events at other Norfolk-area sites as directed
• Coordinate and collaborate with Military, Government, and Contractor leadership

Intelligence Analyst – Military Operations Analyst 3

• Document requirements, specifications, business processes, and recommendations for proposed solutions
• Understand business issues and organizational data challenges
• Evaluate real-time data to identify substandard systems processes and drive requirements awareness across business units
• Provide day-to-day support for close-related Workday processes
• Troubleshoot issues and recommend configuration improvements with Accounting stakeholders
• Communicate with department SMEs to identify needs and evaluate alternative business solutions
• Enhance connections with existing and new interfaces
• Establish and apply a repeatable methodology for change management activities driven by FSA
• Coordinate user acceptance testing, write testing scenarios, support process improvement, and assist with issue resolution
• Manage change by addressing resistance and ensuring smooth transitions
• Lead projects, ensure task completeness, and communicate updates to leadership
• Support development of training and procedures for process optimizations and new projects
• Support testing and communication of Workday semi-annual release updates and assess impacts on Financial Accounting/R2R processes
• Conduct data-driven assessments to identify bottlenecks, inefficiencies, and waste
• Monitor close-cycle data and reconciliation status to flag issues and support process improvements

Threat Intelligence Specialist jobs in United States

Intelligence Analyst

Senior Intelligence Analyst

Senior Intelligence Analyst

Market Intelligence Analyst

Distinguished Threat Hunter

Lead Intelligence Analyst

Cyber Threat Intelligence Analyst, Scams

Senior / Staff Intelligence Analyst, Environmental Crimes

Intelligence Analyst – Military Operations Analyst 3

Financial Intelligence Analyst – Workday