Lead Cyber Threat Intelligence Analyst

Job Overview Cyber Threat Intelligence Lead Analyst at U.S. Bank. Responsibilities Conduct hands‑on cyber threat intelligence analysis focused on threat actors, campaigns, tactics, techniques, procedures, infrastructure, malware, phishing, ransomware, cybercrime and emerging financial‑sector threats. Produce tactical, operational, and strategic intelligence products including threat assessments, intelligence reports, executive briefings, RFIs, threat actor profiles and actionable recommendations. Own and support the intelligence lifecycle: requirements gathering, collection, analysis, enrichment, dissemination and feedback. Translate raw threat data, OSINT, vendor intelligence, dark‑web research, internal telemetry and partner reporting into clear, actionable intelligence. Support threat hunting, detection engineering, incident response, vulnerability management, fraud and broader cyber defense teams with intelligence‑driven context and prioritization. Develop and refine Priority Intelligence Requirements, collection priorities, analytical workflows and reporting processes to improve the quality and relevance of CTI outputs. Analyze threat actor behavior and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk‑based decision‑making. Brief technical, business and senior leadership stakeholders on cyber threats, trends, potential business impact and recommended actions. Mentor and guide other analysts through influence, trade‑craft coaching, intelligence writing and analytical review. Help mature CTI processes, tools, reporting standards and intelligence outputs while remaining closely engaged in hands‑on analysis. Requirements 5+ years of hands‑on Cyber Threat Intelligence experience in a dedicated CTI, cyber intelligence or threat intelligence function. Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis and intelligence production. Strong understanding of the intelligence lifecycle including requirements, collection, analysis, dissemination and stakeholder feedback. Proven ability to produce clear, actionable intelligence reports, assessments, briefings or RFIs for technical and non‑technical stakeholders. Experience supporting threat hunting, incident response, detection engineering, vulnerability management or security operations through intelligence outputs. Ability to clearly and concisely explain cyber threat intelligence work, including specific examples of methodology, analysis performed, intelligence produced and resulting action. Experience mentoring, guiding or influencing other analysts as a senior individual contributor or functional lead. Strong written and verbal communication skills with the ability to translate complex threat activity into business‑relevant risk and decision support. Familiarity with CTI tools, vendors, frameworks and sources such as OSINT, dark‑web sources, ISACs, Recorded Future, Mandiant, Flashpoint, Anomali, ThreatConnect, VirusTotal or similar platforms. Experience using MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behavior. Nice to Have Cyber threat intelligence experience within financial services, banking, fintech, payments or another highly regulated industry. Experience building or maturing CTI processes such as Priority Intelligence Requirements, collection plans, reporting standards, RFI workflows or intelligence dissemination models. Experience with ransomware, cybercrime, fraud‑related threat intelligence, third‑party exposure, credential exposure or financial‑sector adversary activity. Experience conducting dark‑web, underground forum or cybercrime ecosystem research. Experience briefing senior leaders, executives or business stakeholders on cyber threats and risk‑based recommendations. Exposure to AI use cases within CTI, intelligence collection, analysis acceleration or reporting efficiency. Experience collaborating with external intelligence‑sharing groups such as FS‑ISAC, InfraGard, CISA, law enforcement or intelligence community partners. Relevant certifications such as GCTI, GCIH, GCFA, CISSP, Security+, or similar cybersecurity or intelligence certifications. Benefits Healthcare (medical, dental, vision) Basic term and optional term life insurance Short‑term and long‑term disability Pregnancy disability and parental leave 401(k) and employer‑funded retirement plan Paid vacation (from two to five weeks depending on salary grade and tenure) Up to 11 paid holiday opportunities Adoption assistance Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law Additional Information Equal opportunity employer statement: “U.S. Bank is an equal opportunity employer. We consider all qualified applicants without regard to race, religion, color, sex, national origin, age, sexual orientation, gender identity, disability or veteran status, and other factors protected under applicable law.” Location: Requires working from a U.S. Bank location three or more days per week. This position is not eligible for visa sponsorship. Pay range: $126,820.00 – $149,200.00. #J-18808-Ljbffr U.S. Bank