Threat Intelligence Analyst - IBM CISO

We are seeking an experienced Cyber Threat Intelligence (CTI) Analyst to join our team. As a CTI Analyst within the Office of the IBM CISO you will conduct all-source intelligence operations, which includes Gathering CTI that is relevant and actionable by IBM.

• Maintaining relevant, up-to-date and accurate data on threat activity clusters, nexuses, malware, tools, infrastructure, attack patterns and campaigns.
• Supporting other cyber defence teams such as Incident Response, Security / Network Operations Centres, Threat Hunting, Vulnerability Response and Engineering.
• Overall, your intelligence end products will be used to counter threats to IBMs systems, networks, users and clients.
• The ideal candidate will understand the principles, processes and practices of CTI, have a strong analytical mindset and very good communication skills. This includes written report writing.
• A technical background in data manipulation (such as extract-transform-load, extract-load-transform), scripting or programming is desirable but not essential.

Key Responsibilities:

• Threat Intelligence: Collect, process, analyze and disseminate cyber threat intelligence from internal and external sources. Identify patterns and trends to anticipate, detect and mitigate potential threats.
• Perform contextualization on data and intelligence materials to determine their relevance and risk to IBM based on business operations, location, technology usage and victimology.
• Apply your skills to form hypotheses, critically assess and apply analysis techniques to query, merge, enrich, evaluate, and pivot within data to obtain and share insights with other IBM teams.
• Alert and Case Analysis: Analyze and investigate suspicious activities detected by our Security Operations Centre and Cyber Security Incident Response Team to assess the level of threat by correlating intelligence with sightings made within the IBM environment.
• Incident Response: Assist Incident Responders by enriching investigations, sightings and alerts with valid, qualified and contextualized intelligence. Vulnerability Assessment: Monitor for Proofs-of-Concept and exploitation of relevant vulnerabilities.
• Collaboration: CTI Analysts are expected to collaborate in (virtual) teams and across the CISO organization like SOC, Threat Hunting and CSIRT.

At times, they collaborate directly with other IBM functionssuch as commercial business units, supply chain, and researchto model, contextualize, assess, detect, and help mitigate specific threats.