Required :

- Experience in threat intelligence, threat monitoring, or SOC/CTI operations.

- Solid grounding in the Threat Intelligence Lifecycle and structured analytical techniques, and frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK.

- Ability to produce clear, accurate analytical products and communicate them to audiences of varying technical depth, with excellent English language skills.

- Hands-on technical ability - Python or scripting, API integrations, and lightweight workflow building.

- Working knowledge of detection logic and telemetry.

- Experience with at least one Threat Intelligence Platform, ideally Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, or Recorded Future.

- An AI-native working style - you integrate LLMs and automation tools into your daily monitoring, enrichment, and analytical workflow.

- Composure under pressure - you deliver clearly and effectively during incidents and time-critical escalations.

Preferred :

- Background in Incident Response, SOC operations, or digital forensics.

- Hands-on detection engineering experience, ideally authoring rules in Google SecOps or CrowdStrike.

- Prior experience in IT administration (server, network, endpoint).

- SANS FOR578 (Cyber Threat Intelligence) or equivalent certification.

- Familiarity with threat sharing platforms (MISP) and large-scale IOC management.

- Experience with SOAR platforms, N8N, or Power Automate.

- Data and Process visualization proficiency (Grafana, advanced Excel, PowerPoint).

- Certifications: GIAC (GCTI, GCIH, GCFA), CISSP, or OSCP.

Who You Are :

- A bridge-builder - you are equally comfortable with an analyst's judgment and an engineer's toolkit.

- Vigilant and curious - you notice what others scroll past.

- A builder - you identify gaps and close them without waiting for instruction.

- Autonomous and outcome-driven.

- A communicator - you understand that ultimately people execute defenses.

- Energized by transformation.

- Process-aware without being process-bound.

- Collaborative across boundaries - in our pooled model, you will work across squads (Monitoring, Intrusion Analysis, TTP & Threat Actor Analysis, IOC Handling) and partner daily with detection engineers and incident responders.

- Exposure in AI, GenAI and Agentic AI preferred.