Cybersecurity Intel Analyst, Threat Intelligence

About the company

We are a young and fast-growing recruiting company with five years of experience working across Latin America and the United States. We partner closely with teams and founders to help them build strong, high-impact teams through recruitment, outsourcing, and team-building services.

Our culture is built on effective communication, trust, and transparency. We believe great work happens when people feel heard, supported, and empowered to grow. Today, our team is made up of more than 80 professionals working across different projects throughout the region, collaborating remotely and learning from each other every day.

About the role

We are looking for a Senior Cyber Threat Intelligence & SOC Analyst to join a Security Operations Center responsible for protecting the organization's digital infrastructure, data, and operations on a 24/7/365 basis.

This is primarily a cybersecurity role, combining threat intelligence, threat hunting, security monitoring, incident triage, and incident response. The position also acts as a bridge between the SOC and the Global Security Operations Center (GSOC), identifying when cyber incidents may have a physical or personnel security dimension and coordinating the appropriate response.

You will monitor emerging threats, analyze adversary activity and TTPs, investigate security alerts, coordinate the initial response to confirmed incidents, and produce actionable intelligence for both technical teams and senior leadership.

As a senior member of the team, you will also review intelligence products, mentor junior analysts, improve detection and response processes, and contribute to the continuous evolution of the SOC and CTI program.

Responsibilities

• Monitor cyber threat intelligence feeds, dark-web sources, ISAC/ISAO intelligence, and OSINT sources to identify threats targeting infrastructure, personnel, operations, and supply chains.
• Track threat actors, campaigns, and TTPs using MITRE ATT&CK, with particular attention to threats affecting industries such as energy, mining, and digital assets.
• Develop and maintain threat profiles covering nation-state actors, financially motivated groups, hacktivists, insider threats, and other relevant adversaries.
• Produce timely intelligence reports, threat advisories, security alerts, and executive briefings, including rapid reporting during significant events.
• Triage and investigate security alerts generated by SIEM, EDR, and other detection technologies, determining severity and when escalation to Tier 2/Tier 3 analysts or security leadership is required.
• Coordinate the initial response to confirmed cybersecurity incidents, supporting scoping, containment, escalation, and communication with relevant stakeholders.
• Identify when a cyber incident may also involve physical or personnel security — such as compromised accounts connected to facility access attempts or phishing campaigns targeting executives — and coordinate with the GSOC.
• Support crisis communications and coordination with internal teams and external partners, including incident response providers and law enforcement when required.
• Monitor emerging CVEs and vendor security advisories, identifying vulnerabilities relevant to the organization's technology environment and escalating high-priority risks.
• Support threat modeling and risk assessments for new technology deployments, projects, and supply-chain partners.
• Monitor exposure of company assets — including domains, IP addresses, credentials, and code — across open-web and dark-web sources and issue alerts when actionable findings are identified.
• Serve as a senior quality reviewer for SOC and CTI deliverables, ensuring alerts, reports, and briefings are accurate, actionable, and clearly communicated.
• Mentor and support junior CTI and SOC analysts across a follow-the-sun operating model.
• Contribute to scheduling and coverage of the 24/7/365 SOC operation, including backfilling monitoring and response shifts during coverage gaps when required.
• Help define, track, and report CTI and SOC KPIs, including metrics such as MTTD, MTTR, and intelligence consumption.
• Drive continuous improvement of detection rules, incident-response playbooks, threat-intelligence workflows, and security tooling integrations.

Requirements

• 4–6+ years of experience in Cyber Threat Intelligence, SOC Analysis, Information Security, or related cybersecurity roles, with increasing levels of responsibility.
• Hands-on experience investigating and triaging security events using SIEM platforms such as Splunk, Microsoft Sentinel, Chronicle, or equivalent.
• Experience working with EDR technologies and endpoint security telemetry.
• Hands-on experience with Threat Intelligence Platforms (TIPs) such as Recorded Future, Mandiant Advantage, OpenCTI, MISP, or similar.
• Strong knowledge of the MITRE ATT&CK framework, including the ability to map observed TTPs to adversary groups and translate intelligence into actionable detection improvements.
• Strong experience with OSINT methodologies, including dark-web research, social-media investigation, and passive reconnaissance.
• Working knowledge of network protocols, log analysis, malware indicators, and common attack vectors such as phishing, credential stuffing, ransomware, and supply-chain compromise.
• Experience supporting cyber incident triage and response, including escalation, initial containment coordination, and stakeholder communication.
• Excellent English communication skills, with the ability to produce clear technical reports and executive-level briefings.
• Ability to prioritize and make decisions quickly during high-tempo security incidents or crisis situations.
• Strong judgment and discretion when handling confidential and sensitive information.
• Availability to work a flexible schedule and provide coverage during nights, weekends, or holidays when required by the 24/7/365 operation.
• Ability to pass the required background check and legal eligibility requirements applicable to the role's location.

Nice to have

• Security certifications such as GCIA, GCTI, GCFE, OSCP, CEH, CISSP, CompTIA Security+, or equivalent.
• Experience with Python or PowerShell for automating threat-intelligence workflows, security investigations, or SIEM queries.
• Familiarity with cloud security environments such as AWS, Azure, or GCP, as well as SaaS threat monitoring.
• Exposure to physical security, GSOC operations, or combined Cyber-Physical SOC environments.
• Experience supporting organizations operating global supply chains or within industries such as energy, mining, digital assets, or fintech.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related field.

Benefits

• People First culture
• Referral Program
• Free access to streaming platforms
• Free access to Spotify Premium
• GYM discount
• Travel discount
• E-Learning discount
• Birthday-day gift
• Points Program