Minimum qualifications:

• Bachelor's degree or equivalent practical experience.
• 5 years of experience in a customer-facing role in cyber intelligence and cyber operations.
• Experience working with security operations functions such as SOC tier 1/2, Hunt teams, executive managers, CISO.
• Experience working in a government or military environment, developing cyber threat intelligence for network, host and log analysis, to enable the detection and response to cyber threats.
• Experience analyzing Indicators of Compromise (IOCs) including sandbox output.

Preferred qualifications:

• Experience in leveraging CTI to describe, track and develop new intelligence on advanced persistent threats.
• Experience of network IDS monitoring, EDR solutions, SIEM and Security Orchestration, Automation and Response (SOAR) integration, and managing and contributing CTI into a Threat Intelligence platform.
• Experience of conducting or supporting incident response and investigations within enterprise environments.
• Experience in SOC operations, threat hunting, detection engineering and SOC workflow optimization.
• Understanding of core cyber security concepts, common enterprise IT infrastructure components, operating system internals and networking.
• Eligibility and willingness to undergo Security Checked (SC) security clearance, and ability to maintain it.

About the job

Responsibilities

• Serve as the Advanced Intelligence Access (AIA) integrator for a customer.
• Build understanding of the customers Cyber Threat Intelligence (CTI) requirements. Identify their needs and opportunities for deployment of CTI within their operations to have the greatest defensive impact.
• Track, research and contribute CTI analysis within Google Threat Intelligence, of customer's priority threat concerns.
• Support the integration of CTI into customer's security processes and technologies, including SIEM and Threat Intelligence Platform (TIP) systems. 
  
• Generate CTI, and perform analysis of customer data, taking their bespoke sources to identify threat activity, or to build and automate investigative workflows.