Threat Intelligence Analyst

Threat Intelligence Analysts / Engineers are responsible for collecting data, researching threats, analyzing data, and creating actionable insights for key stakeholders to improve enterprise detection, response, and risk awareness.

This role combines deep technical skills (scripting, sandboxing, automation) with threat analysis with operational security engineering insight. Analysts identify collection opportunities, track adversary activity, and investigate campaigns while creating the scripts and tooling to deliver at scale.

Threat Intelligence Engineers work closely to provide actionable inputs for Blackthorne’s detection engineering, threat hunt, and adversary emulation teams to ensure that intelligence directly improves defensive capabilities.

Blackthorne is a mission-focused consulting organization, and we hire professionals who combine strong technical expertise with accountability, collaboration, and a commitment to measurable Client outcomes.

Conduct Threat Intelligence Research
- Track adversary groups and campaigns relevant to enterprise environments.
- Identify and exploit data collection opportunities.
- Analyze emerging threat techniques, malware families, and attack infrastructure.
- Build automation to drive analysis at scale.
- Perform in-depth, high interaction analysis of phishing campaigns, command-and-control infrastructure, and attacker tooling.

Build Intelligence Engineering Capabilities
- Develop automation pipelines to collect, normalize, and enrich threat intelligence data.

- Maintain internal intelligence repositories and campaign tracking systems.
- Build and maintain basic APIs to integrate with enterprise security platforms where possible.
- Evaluate threat intel feeds and data sources for critical features such as timeliness, reliability, and relevancy.

Deliver Intelligence Insights to Clients
- Produce threat intelligence reports and campaign analyses.
- Deliver technical briefings to security teams and executive stakeholders.
- Support incident investigations by providing adversary context and attribution insights.
- Assess any existing or desired client threat intel functions and develop actionable requirements through roadmaps to improve client maturity.

Key Deliverables

Threat Intelligence Analysts are accountable for producing measurable outputs including:
- Threat actor profiles and campaign analyses
- Intelligence automation pipelines
- Client threat briefings
- Assessments of client threat intel capabilities

Success is measured through improvements in detection coverage, faster incident response, and actionable intelligence adoption by Clients.

Minimum Qualifications
- 4+ years experience in threat intelligence
- 2+ years experience writing analysis scripts or other applicable automation
- 2+ years experience with sandboxes and sandboxing technology
- 2+ years experience tracking criminal threat actors
- Experience analyzing adversary tactics and campaigns
- Familiarity with enterprise attack techniques
- Experience producing technical intelligence reports
- Ability to translate threat intel insights into actionable threat detection, threat hunt, or other control recommendations

Preferred Qualifications
- 2+ years experience working as a threat intelligence analyst in a professional organization
- Demonstrated track record of open source contributions or conference talks related to automated analysis of threat data, sandboxing or other related topics
- Malware analysis experience (including experience writing and maintaining Yara signatures)
- Experience tracking nation-state actors
- Experience with threat intelligence platforms (MISP, OpenCTI, etc.)
- Python or other scripting experience