Cyber Threat Intelligence Analyst (REMOTE - PST)

Job Description

Insight Global's client, a leading company within the Gaming & Technology industry, is seeking a Cyber Threat Intelligence Analyst to support its growing threat intelligence function. This team operates across traditional cyber threat intelligence, gaming-specific intelligence, leak/IP investigations, and emerging security threats.

The immediate need is for experienced CTI practitioners who can help evaluate a high volume of threat information, identify meaningful signals, investigate relevance to their environment, and turn intelligence into actionable security outcomes.

The ideal candidate is a persistent, curious problem-solver who is comfortable operating independently in a fast-moving environment and actively embraces AI and automation to improve the speed and effectiveness of intelligence work.

Core Responsibilities

• Monitor and analyze cyber threat intelligence from internal and external sources.
• Evaluate threat reporting and determine its potential relevance to Epic.
• Analyze indicators, TTPs, attacker infrastructure, and emerging threat activity.
• Investigate security telemetry and log data to validate potential threats.
• Help differentiate meaningful security signals from high-volume intelligence noise.
• Translate intelligence into actionable outcomes such as detections, mitigations, takedowns, investigations, or hardening recommendations.
• Support incident response with relevant threat intelligence and analysis.
• Conduct OSINT and threat infrastructure research.
• Partner with CTI, Security Operations, Threat Hunting, Security Engineering, and other InfoSec teams.
• Leverage AI/LLMs and automation to accelerate intelligence collection, enrichment, analysis, and triage.
• Continuously learn new technology and identify opportunities to improve CTI processes.

Skills and Requirements

• 3+ years of experience in cyber threat intelligence, threat hunting, security operations, or incident response.
• Experience using LLMs, AI agents, or automation to speed up intelligence collection and triage.
• Working knowledge of the intelligence lifecycle and analytic frameworks such as MITRE ATT&CK, the Diamond Model, or the Cyber Kill Chain.
• Experience querying security telemetry in tools such as Splunk, CrowdStrike, or similar SIEM and EDR platforms.
• Experience with threat intelligence sources and platforms such as Flashpoint, Recorded Future, VirusTotal, or similar.
• Hands-on OSINT and infrastructure analysis skills, including:
• Passive DNS and WHOIS
• Certificate transparency
• Hosting and IP pivoting
• Underground forum and marketplace research
• Scripting experience (Python, PowerShell, Bash, etc.) to automate collection, enrichment, or hunting.
• Clear written communication for both technical teams and leadership audiences.
• Sound judgment and discretion when handling sensitive information.
• Experience with setting up monitoring platforms or TIP
• Experience in gaming, technology, or consumer platforms with large user bases.
• Familiarity with infostealer malware, credential markets, and the criminal ecosystems behind them.
• Experience writing or contributing to detections (Splunk SPL, Sigma, YARA, or similar).
• Experience with link analysis or graphing tools to map threat actor infrastructure.
• GCTI, GCIH, GCFA, CTIA, or similar certifications.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [email protected].