Technical Skills and Experience:
- Strong background in Cyber Threat Intelligence (CTI), ideally 3-5 years in threat intel roles.
- Hands-on experience with Recorded Future or similar threat intelligence platforms.
- Familiarity with Microsoft E5 security stack (Defender, Sentinel) and how to enrich detections
with threat intel. - Familiarity with Azure cloud security.
- Knowledge of SIEM/SOAR integration and automation workflows.
- Proficiency in threat actor profiling, TTP analysis (MITRE ATT&CK framework), and IOC
management. - Experience with dark web monitoring, OSINT collections, and malware analysis basics.
- Understanding of incident response workflows to ensure CTI outputs are actionable for L1/L2
teams. - Know how to do threat hunting and knowledgeable in use case management or creation of
detection rule. - Experience with security incident response.
Communication and Analytical Skills:
- Strong ability to translate technical threat data into business-relevant intelligence for
leadership. - Skilled in writing clear, concise intelligence reports (strategic, operational, tactical).
- Capable of briefing both technical SOC teams and non-technical executives.
- Analytical mindset to connect disparate data points into meaningful threat narratives.
- Comfortable presenting findings in meetings and collaborating with MSPs.
Soft Skills and Additional Requirement:
- Collaboration: Works well with IR teams and external MSPs.
- Critical Thinking: Challenges assumptions, validates intelligence before dissemination.
- Curiosity: Proactively hunts for emerging threats and keeps up with evolving TTPs.
- Resilience: Handles high-pressure situations during active incidents.