Kroll Cyber Threat Intelligence (CTI) is seeking an experienced Manager, Cyber Threat Intelligence to lead and develop a team of L2 and L3 Associates delivering complex intelligence and investigative services to Kroll clients globally. The Manager will also oversee CTI's summer internship program, providing interns with structured exposure to intelligence research, investigative tradecraft, analytical methodologies and professional development.
The Manager will serve as a critical link between CTI leadership and the Associate team, providing day-to-day management, investigative oversight, quality assurance and professional development. The position will also carry significant client-facing and commercial responsibilities, including engagement scoping, proposal development, resource estimation, business development and identification of opportunities to expand Kroll's CTI services.
The position is designed as a working manager role, requiring the individual to balance people leadership with investigative expertise, client engagement and commercial responsibility.
Key Responsibilities:
Team Leadership and Development
- Provide direct day-to-day leadership, coaching and development for L2 and L3 Associates within Kroll CTI.
- Allocate investigative assignments based on complexity, client requirements, analyst capability, resource availability and professional-development objectives.
- Manage workloads and priorities across concurrent client matters and internal initiatives.
- Review analyst research, investigative methodologies, analytical judgments and written deliverables to ensure they meet Kroll quality standards.
- Establish clear expectations for investigative rigor, documentation, source evaluation, analytical confidence and client-ready communication.
Deep & Dark Web Investigations
- Supervise and, where appropriate, lead complex investigations across the open, deep and dark web, including underground forums, marketplaces, leak sites, illicit communities, messaging platforms, credential repositories and other restricted-access sources.
- Oversee investigations involving threat actors, ransomware and extortion activity, leaked or stolen information, compromised credentials, fraud, executive exposure and other emerging cyber threats.
- Guide analysts in developing collection plans, investigative hypotheses, search strategies, personas, source lists, keywords and monitoring methodologies.
- Ensure findings are properly corroborated and evaluated for source reliability, credibility, relevance and analytical confidence.
- Ensure investigative activities adhere to applicable Kroll policies, legal requirements, ethical standards and client confidentiality requirements.
- Maintain appropriate investigative documentation and defensible analytical and evidentiary trails.
- Convert complex investigative findings into clear assessments of client risk and recommended actions.
Due Diligence and Investigative Intelligence
- Lead CTI support for complex cyber due diligence and investigative matters, working with Kroll cyber, investigative, financial, legal and advisory professionals as appropriate.
- Direct cyber-risk and digital-exposure research involving organizations, executives, transactions and other subjects of interest.
- Integrate deep and dark web intelligence, OSINT, digital footprint analysis and other investigative techniques to develop comprehensive intelligence assessments.
- Identify cyber threats, historical exposures, compromised information, threat actor interest and other indicators that may materially affect a transaction or client decision.
- Translate fragmented technical and investigative information into defensible intelligence assessments for executives, investors, counsel and other decision-makers.
- Coordinate CTI support with other Kroll capabilities when matters require a multidisciplinary investigative approach.
Protective Intelligence
- Manage protective intelligence engagements involving executives, high-net-worth individuals and other persons requiring enhanced security awareness or protection.
- Oversee assessments of publicly and illicitly available personally identifiable information, digital exposure, impersonation risk, social-media exposure, unusual online interest and emerging threats.
- Direct digital-footprint, threat-actor and online behavioral research associated with protective-intelligence requirements.
- Identify the intersection between cyber, digital and potential physical risks and escalate material findings appropriately.
- Coordinate CTI findings with Kroll security, investigative and risk professionals where physical and cyber risks converge.
- Ensure protective-intelligence findings are translated into clear risk assessments and practical mitigation recommendations.
Business Development, Scoping & Commercial Support The Manager will have an active role in growing Kroll CTI and transforming client requirements into technically sound, operationally achievable and commercially viable engagements.
Responsibilities will include:
- Participate in client discovery and scoping discussions to understand business objectives, investigative questions, threat concerns, intelligence requirements, timelines and desired outcomes.
- Advise clients and internal Kroll stakeholders on the appropriate CTI capabilities and investigative methodologies for addressing identified requirements.
- Translate client requirements into clearly defined scopes of work, including investigative methodology, collection requirements, deliverables, assumptions, timelines and resource requirements.
- Develop scopes for Deep and Dark Web investigations, cyber due diligence, protective intelligence, executive exposure assessments, threat actor investigations, persistent monitoring and bespoke intelligence engagements.
- Estimate analyst hours, level of effort, technology requirements and appropriate L2, L3 and Manager staffing to support engagement pricing and profitability.
- Participate in client presentations and articulate Kroll CTI's capabilities, methodologies and value proposition to technical and executive stakeholders.
Summer Internship Program The Manager will have primary responsibility for the Kroll CTI Summer Internship Program, including:
- Develop a structured internship curriculum with defined learning objectives and measurable outcomes.
- Select investigative and intelligence assignments appropriate for intern participation.
- Assign mentors and coordinate support from L2 and L3 Associates.
- Provide foundational training in OSINT, Deep and Dark Web research, source evaluation, intelligence analysis and professional report writing.
- Create supervised opportunities for interns to contribute to appropriate due diligence, protective intelligence and DDW investigations.
- Conduct regular check-ins, coaching sessions, performance feedback and end-of-program evaluations.
- Ensure internship activities comply with applicable Kroll information-security, privacy, ethics and client-confidentiality requirements.
- Identify high-performing interns as potential candidates for future L2 Associate opportunities, establishing the internship program as an intentional component of Kroll CTI's talent pipeline.
Client and Engagement Management
- Serve as a primary quality-control and escalation point for Associate-led investigations.
- Review significant client deliverables prior to release.
- Participate in and, as appropriate, lead client calls, investigative briefings and intelligence presentations.
- Manage client expectations concerning scope, deliverables and timelines.
- Maintain clear communication with clients and internal Kroll stakeholders throughout the engagement lifecycle.
- Capture lessons learned and identify opportunities to improve investigative methodologies, operational procedures and service delivery.
Required Experience and Qualifications:
- Approximately 4+ years of relevant professional experience, with demonstrated progression in cyber threat intelligence, investigations, OSINT, due diligence, protective intelligence, cybercrime research or a comparable discipline.
- Prior experience supervising, mentoring or serving as a senior reviewer for analysts or investigators.
- Demonstrated hands-on knowledge of open-source, deep web and dark web investigative methodologies.
- Working knowledge of cybercrime ecosystems, underground forums and marketplaces, ransomware/extortion operations, credential exposure and digital risk.
- Experience evaluating source reliability, information credibility and analytical confidence.
- Experience producing professional investigative reports, intelligence assessments and executive-level briefings.
- Experience interacting directly with clients and internal business stakeholders.
- Ability to scope investigative work, estimate resources and contribute to proposals or statements of work.
- Excellent written and verbal communication skills.
- Strong professional judgment and discretion when handling sensitive, confidential or privileged matters.
Preferred Qualifications
- Consulting or professional-services experience.
- Experience conducting or managing corporate and individual due diligence investigations.
- Protective intelligence or executive-threat assessment experience.
- Experience supporting legal counsel or investigations involving privileged or confidential information.
- Experience applying threat intelligence during cyber incident response or other high-profile investigations.
- Experience developing junior analysts or managing internship or graduate programs.
- Familiarity with structured intelligence methodologies and analytical tradecraft.
- Experience with business development, engagement scoping, proposal development and professional-services pricing.
- Demonstrated ability to identify follow-on opportunities and develop trusted client relationships.
Success in the Role
Success will be measured by the Manager's ability to develop a strong pipeline of CTI talent while maintaining consistent investigative and analytical quality across client matters. The Manager should progressively enable L2 Associates to develop independent investigative skills, prepare L3 Associates for greater engagement and technical leadership responsibilities, and establish the summer internship program as a meaningful pipeline for future CTI talent.
The Manager will also serve as an operational bridge between CTI leadership and the Associate population, providing the day-to-day supervision, quality control and professional development necessary to allow senior CTI leadership to focus on complex engagements, strategic clients, service development and growth.
Importantly, success will also be measured by the Manager's ability to convert client needs into well-defined, appropriately priced and operationally executable CTI engagements. The Manager will contribute directly to pipeline development, client discovery, proposals and scoping; identify opportunities for follow-on and recurring work; and ensure that work committed to clients can be delivered efficiently, profitably and to Kroll's quality standards.
Role Summary
At its core, this L4 Manager position carries five interconnected accountabilities:
- People Leadership: Develop and manage L2 Associates, L3 Associates and interns.
- Intelligence Leadership: Maintain investigative and analytical quality across DDW, due diligence and protective-intelligence matters.
- Client Leadership: Translate intelligence into meaningful client decisions and actionable recommendations.
- Commercial Leadership: Scope, price and support the pursuit of profitable CTI engagements and identify opportunities for growth.
- Capability Development: Improve methodologies, standardized offerings and the overall scalability and maturity of Kroll CTI.
Your recruiter will be happy to walk you through your U.S.-specific benefits, which include:
- Healthcare Coverage: Comprehensive medical, dental, and vision plans.
- Time Off and Leave Policies: Generous paid time off (PTO), paid company holidays, generous parental and family leave.
- Protective Insurances: Life insurance, short- and long-term disability coverage, and accident protection.
- Compensation and Rewards: Competitive salary structures, performance-based incentives, and merit-based compensation reviews.
- Retirement Plans: 401(k) plans with company matching.
Please note that benefits may vary by region, department and role. We encourage you to speak with your recruiter to learn more about the specific benefits available for your position.
About Kroll
Join the global leader in risk and financial advisory solutions - Kroll. With a nearly century-long legacy, we blend trusted expertise with cutting-edge technology to navigate and redefine industry complexities. As a part of One Team, One Kroll, you'll contribute to a collaborative and empowering environment, propelling your career to new heights. Ready to build, protect, restore and maximize our clients’ value? Your journey begins with Kroll.
In order to be considered for a position, you must formally apply via careers.kroll.com.
We are proud to be an equal opportunity employer and will consider all qualified applicants regardless of gender, gender identity, race, religion, color, nationality, ethnic origin, sexual orientation, marital status, veteran status, age or disability.
The current salary range for this position is $120,000 to $140,000