Lead / Principal / Senior Cyber Threat Intel Analyst

About the role

The Cyber Threat Intelligence Analyst protects critical IT/OT systems in the land transportation sector by actively researching emerging threats and turning global threat data into localised, actionable monitoring strategies and detection logic. The role leads the Threat Intelligence (TI) function and acts as Tier-3 intelligence lead during critical incidents.

Key responsibilities

• Develop and continuously improve the TI function, including SOPs and a CTI solution for collection, analysis and dissemination.
• Research threat actor TTPs, focusing on the Asia-Pacific region and Industrial Control Systems (ICS).
• Maintain high-fidelity monitoring lists of IOCs for SIEM, EDR and network traffic analysis tools.
• Turn research into detection artefacts such as YARA, Sigma or Snort rules.
• Provide real-time threat context, infrastructure pivoting and attribution support to the CERT team during incidents.
• Monitor and prioritise new CVEs and map adversary behaviour to MITRE ATT&CK.
• Produce intelligence reports, flash alerts and monthly strategic summaries for management and operators.

Required profile

• Bachelor's degree in Computer Science, Information Security or a related discipline.
• At least 8 years in cybersecurity, with at least 4 years in Threat Intelligence, Advanced SOC Operations or Incident Response.
• GIAC Cyber Threat Intelligence (GCTI) or CISSP; GCIH, GCFA or GREM are advantageous.
• Track record of mentoring junior analysts and improving SOC/CERT capabilities.
• Strong technical writing and communication skills, able to brief senior leadership.

Required skills

• Open-source investigation across surface, deep and dark web sources.
• Scripting to build scrapers and automate TIP workflows.
• Log correlation with proxy, firewall and EDR logs.
• MITRE ATT&CK, Diamond Model of Intrusion Analysis and Cyber Kill Chain.