Senior Cyber Intelligence Analyst

If you are motivated and believe in the credit union philosophy of People Helping People join our team!

About the role

The Senior Cyber Intelligence Analyst is the technical lead for intelligence-driven detection and exposure management. You own the analytic tradecraft the detection engineering standards and the intelligence products that shape how the organization prioritizes vulnerabilities builds detections and briefs leadership. You set the bar for the teams Splunk work mentor analysts and represent threat intelligence to peer teams and executives.

This is a senior individual-contributor role with real ownership. You are expected to define how the work gets done not just do it and to make defensible analytic calls that leadership will act on.

What you will do

Lead threat intelligence and analysis

• Own the intelligence requirements process: define priority intelligence requirements with stakeholders maintain the collection plan and evaluate feed and vendor value.
• Lead analysis of threat actors campaigns malware families and TTPs relevant to financial services our technology stack and our third-party ecosystem mapped to MITRE ATT&CK.
• Produce and quality-review decision-ready intelligence products at the tactical operational and strategic levels including briefings for the CISO and contributions to governance and Board-level reporting.
• Own the threat-informed assessment of newly disclosed vulnerabilities (CISA KEV EPSS exploit availability vendor advisories) and drive that assessment into vulnerability prioritization and emergency remediation decisions.
• Lead intelligence support to incident response: attribution campaign context indicator enrichment and post-incident lessons that become detections and requirements.
• Represent the organization in industry sharing communities (FS-ISAC and peer groups) and build relationships with vendor and government intelligence contacts.

Lead detection engineering

• Own the detection engineering program in Splunk Enterprise Security: standards lifecycle coverage measurement and the tuning process.
• Design and build high-value detections correlation searches and risk-based alerting (RBA) logic; review and mentor others detection work.
• Maintain the MITRE ATT&CK coverage map prioritize gaps against current threat intelligence and crown-jewel assets and drive a roadmap to close them.
• Establish detection-as-code practices: version control peer review testing against replayed or emulated attack data and controlled deployment.
• Lead purple-team and adversary emulation exercises to validate detections and measure real coverage rather than assumed coverage.
• Set standards for SPL quality data model use CIM compliance and search performance; partner with the Splunk platform team on data onboarding and platform direction.

Lead threat hunting and exposure management

• Design and run the threat hunting program: hunt hypotheses tied to priority intelligence requirements documented methodology and outcomes that feed detections and remediation.
• Lead cross-source analysis correlating vulnerability data (Tenable) with endpoint (SentinelOne) source control (GitHub) network and edge (F5 Check Point Zscaler) and email (Proofpoint) telemetry to identify exposed exploitable and actively targeted assets.
• Serve as the threat intelligence lead for the continuous threat exposure management (CTEM) program ensuring exposure prioritization reflects real adversary behavior and business impact.
• Provide threat research and detection strategy for emerging programs in AI security software supply chain and third-party risk and application security.

Mentor influence and report

• Mentor and technically guide analysts on the team; review analytic products and detections for rigor and clarity.
• Own the teams Splunk dashboards and scheduled reporting for intelligence metrics detection coverage hunt outcomes and threat-informed vulnerability metrics that roll up to leadership reporting.
• Influence remediation and control decisions across IT operations application owners and engineering by presenting evidence-based risk assessments.
• Brief executives and governance audiences clearly and credibly including confidence levels and dissenting assessments.

What you bring

Required

• 7 years in cybersecurity with at least 4 years in threat intelligence detection engineering or threat hunting including experience leading work streams or projects.
• Expert hands-on Splunk skills: advanced SPL Splunk Enterprise Security correlation searches risk-based alerting data models CIM and search optimization.
• A track record of building detection programs or coverage strategies not just individual detections and measuring their effectiveness.
• Deep working knowledge of MITRE ATT&CK structured analytic techniques and intelligence product standards (confidence language sourcing analytic rigor).
• Strong understanding of attacker tradecraft across endpoint network identity cloud and email with the ability to translate it into telemetry and search logic.
• Experience integrating threat intelligence into vulnerability prioritization using CVSS VPR EPSS CISA KEV and exploit intelligence.
• Excellent analytic writing and briefing skills; comfortable presenting to executives and defending assessments under scrutiny.
• Demonstrated ability to mentor and raise the technical bar for a team.

Preferred

• Experience in financial services or another regulated environment with familiarity in FFIEC NIST CSF CIS Controls and PCI DSS expectations for threat intelligence and monitoring.
• Experience with Tenable SentinelOne GitHub Advanced Security Zscaler Proofpoint or comparable platforms.
• Python for enrichment automation and data analysis; experience with security APIs and STIX/TAXII; experience operating a threat intelligence platform (TIP).
• Experience with detection-as-code tooling and CI/CD for detections.
• Hands-on experience with CTEM or exposure management platforms.
• Experience running purple-team or adversary emulation programs.
• Certifications such as GCTI GCDA GCFA GREM Splunk Enterprise Security Certified Admin or CISSP.
• Research or practical experience in AI/ML security software supply chain security or application security.

SECU provides equal employment opportunity to all qualified persons regardless of race color religion age sex sexual orientation gender identity national origin genetic information disability veteran status or other classification protected by law.

Disclaimer

State Employees Credit Union reserves the right to fill this role at a higher/lower level based on business need.

Required Experience:

Senior IC