Cyber Threat Intelligence Analyst, Associate

About the role

Morgan Stanley is looking for a Cyber Threat Intelligence Analyst in its Technology division to support technical threat investigations, track cyber adversaries and produce actionable intelligence that strengthens detection, response and risk-informed decision-making.

Key responsibilities

• Conduct proactive threat research and investigative analysis to identify adversary campaigns, capabilities, infrastructure, targeting and TTPs using internal collection, OSINT and commercial intelligence.
• Research and track threat actors, malware families, vulnerabilities, campaigns and emerging threats.
• Triage incoming intelligence alerts, assess relevance, credibility and severity, and escalate actionable findings.
• Write clear threat intelligence reports, threat assessments, investigative summaries and briefings for operational and non-technical audiences.
• Enrich, validate and curate indicators of compromise (IOCs) using open-source, commercial and internal tools.
• Apply frameworks such as MITRE ATT&CK and the Diamond Model to characterise adversary activity.
• Analyse internal and external security data to spot patterns and trends, and partner with threat hunting, incident response and detection engineering teams.
• Contribute to improving CTI analytic processes, playbooks and automation; use scripting and data analysis (e.g. Python) where applicable.

Required profile

• Minimum 4 years of experience in cyber threat intelligence, investigations, threat hunting, SOC, incident response or a related cybersecurity discipline.
• Experience researching threat actors, malware, campaigns and TTPs using internal, open-source and/or commercial sources.
• Experience triaging alerts and investigating intelligence, and strong report writing and communication skills.
• Understanding of intelligence requirements and collection management.
• Ability to work across cybersecurity teams and manage multiple priorities with attention to detail.

Required skills

• Familiarity with MITRE ATT&CK, the Diamond Model and intelligence analysis frameworks.
• Experience enriching indicators such as domains, IPs, URLs, file hashes and malware artifacts.
• Working knowledge of SIEM, endpoint, network or threat intelligence platform tools and security telemetry.
• Scripting or data analysis, preferably Python.
• Nice to have: GCTI, CISSP, CASP+ or similar certifications, and experience with threat intelligence platforms, OSINT and malware analysis tools.