Cyber Intelligence Analyst

If you are motivated and believe in the credit union philosophy of People Helping People join our team!

You will turn external threat reporting and internal telemetry into actionable intelligence build and tune detections in Splunk and help drive the shift from reporting on vulnerabilities toward reducing real exposure. Your analysis directly informs prioritization for the vulnerability management program the detections that protect the enterprise and the threat briefings that reach the CISO and executive leadership.

This is a hands-on role. You will spend as much time writing SPL and correlation searches as you will reading threat reports and you will be expected to close the loop between the two.

Threat intelligence and analysis

• Collect analyze and operationalize threat intelligence from commercial feeds ISACs open sources and vendor advisories.
• Track threat actors campaigns malware families and TTPs relevant to our industry technology stack and third-party ecosystem mapping findings to MITRE ATT&CK.
• Produce clear decision-ready intelligence products: tactical indicator packages operational campaign analysis and strategic briefings for leadership.
• Assess the exploitability and real-world relevance of newly disclosed vulnerabilities (CISA KEV EPSS vendor advisories exploit availability) and feed that assessment into vulnerability prioritization.
• Support incident response with threat context attribution analysis and indicator enrichment.

Detection engineering

• Design build test and tune detections in Splunk Enterprise Security including correlation searches risk-based alerting (RBA) rules and notable event logic.
• Translate intelligence on adversary TTPs into detection coverage; maintain a coverage map against MITRE ATT&CK and identify gaps.
• Write efficient maintainable SPL; build and maintain lookups macros data models and CIM-compliant normalization for new data sources.
• Own the detection lifecycle: hypothesis development validation against test data or purple-team exercises deployment tuning and retirement.
• Reduce false positives and alert fatigue through measurement and iterative tuning.

Threat hunting and exposure management

• Conduct hypothesis-driven threat hunts across Splunk and endpoint network identity and cloud telemetry.
• Correlate vulnerability data (Tenable) with endpoint (SentinelOne) source control (GitHub) network and edge (F5 Check Point Zscaler) and email (Proofpoint) telemetry to surface exposed exploitable and actively targeted assets.
• Contribute to the continuous threat exposure management (CTEM) program by aligning threat intelligence with asset context and business impact.
• Support emerging programs in AI security supply chain / third-party risk and application security with threat research and detection use cases.

Reporting and collaboration

• Build and maintain Splunk dashboards and scheduled reports for threat intelligence metrics detection coverage and hunt outcomes.
• Partner with the Splunk platform team on data onboarding search performance and platform changes.
• Work closely with vulnerability management incident response IT operations and application owners to drive remediation and detection improvements.
• Brief technical and non-technical audiences including contributions to CISO and governance-level reporting.

Required

• 4 years in cybersecurity with at least 2 years focused on threat intelligence detection engineering threat hunting or SOC analysis.
• Strong hands-on Splunk experience: advanced SPL Splunk Enterprise Security correlation searches risk-based alerting data models and CIM.
• Demonstrated experience building and tuning detections from threat intelligence or adversary emulation.
• Working knowledge of MITRE ATT&CK and the ability to apply it to both intelligence analysis and detection coverage.
• Solid understanding of attacker tradecraft across endpoint network identity cloud and email.
• Familiarity with vulnerability management data and prioritization frameworks (CVSS VPR EPSS CISA KEV).
• Strong analytical writing; able to produce concise intelligence products for audiences ranging from engineers to executives.

Preferred

• Experience with Tenable SentinelOne GitHub Advanced Security Zscaler Proofpoint or comparable platforms.
• Scripting in Python for enrichment automation or data analysis; familiarity with APIs and STIX/TAXII.
• Experience with a threat intelligence platform (TIP) and with structured analytic techniques.
• Exposure to CTEM or exposure management platforms.
• Experience with detection-as-code practices (version control testing CI/CD for detections).
• Relevant certifications such as GCTI GCDA GCFA Splunk Core Certified Power User or Enterprise Security Certified Admin or CySA.
• Background in AI/ML security software supply chain security or application security.

SECU provides equal employment opportunity to all qualified persons regardless of race color religion age sex sexual orientation gender identity national origin genetic information disability veteran status or other classification protected by law.

Disclaimer

State Employees Credit Union reserves the right to fill this role at a higher/lower level based on business need.