Sentar is proud to be an employee-owned company, fostering a culture of empowerment, collaboration, and innovation. Sentar is dedicated to developing the critical talent that the connected world demands to create solutions to address the convergence of cybersecurity, intelligence, analytics, and systems engineering. We invite you to join the team where you can build, innovate, and secure your career.
Sentar is seeking a Cyber Threat Intelligence (CTI) Analyst!
Role Description:
The Cyber Threat Intelligence Analyst evaluates adversaries, campaigns, vulnerabilities, and emerging threats relevant to the customer mission and operating environment. The analyst integrates external intelligence with internal security telemetry to explain what is happening, assess potential impact, identify intelligence gaps, and recommend practical defensive actions.
The analyst delivers tactical, operational, and strategic intelligence to Security Monitoring, Security Operations Center, threat hunting, incident response, detection engineering, purple team, and leadership stakeholders. Products must distinguish verified observations from analytical judgments and document sources, confidence, assumptions, and limitations.
Responsibilities:
- Develop and maintain priority intelligence requirements and collection plans with stakeholders; prioritize collection and reporting against mission needs.
- Evaluate government, commercial, open-source, partner, and internal reporting; assess source reliability, corroboration, relevance, and timeliness.
- Track relevant threat actors, campaigns, infrastructure, tools, and tactics, techniques, and procedures; map supported behaviors to MITRE ATT&CK.
- Correlate external reporting with endpoint, network, identity, email, and cloud telemetry to evaluate exposure and support investigations.
- Produce finished intelligence assessments, alerts, actor profiles, and briefings with key judgments, evidence, confidence, gaps, and actionable recommendations.
- Translate intelligence into testable hunt hypotheses and detection requirements; identify expected artifacts, required telemetry, and validation criteria with operational teams.
- Support incident response through adversary context, indicator enrichment, campaign correlation, and assessments of likely follow-on activity.
- Maintain intelligence records and indicators with provenance, timestamps, confidence, relationships, handling restrictions, and review or expiration criteria.
- Coordinate authorized intelligence sharing with customer, government, and industry partners; comply with applicable handling and reporting requirements.
- Maintain SOPs; contribute to capability reviews, exercises, and program evaluations; assess whether intelligence improves operational decisions and defensive coverage.
- Support incident response actions (surge operations).
Qualifications:
Clearance Level: Top Secret (TS) minimum; ability to obtain TS/SCI.
Education: Bachelor's in a technical/managerial discipline + 5 years; HS/GED + 7 years (contract equivalencies apply).
Experience:
All minimum qualifications are required; preferred/highly desired items are not eligibility gates.
- At least 5 years relevant cybersecurity/cyber intelligence experience with a bachelor's degree, or 7 years with HS/GED; contract education equivalencies apply. Includes at least 2 years CTI analysis or substantive cyber threat research supporting security operations, hunting, or incident response; periods may overlap.
- Working knowledge of intelligence lifecycle, requirements, collection planning, source evaluation, analytical confidence, and dissemination.
- Assess sources and independent corroboration; separate facts/assumptions; evaluate alternatives and document uncertainty.
- Research adversary behavior; map evidence-supported MITRE ATT&CK techniques/sub-techniques; distinguish IOCs from behavioral TTPs.
- Understand TCP/IP, DNS, HTTP/S, email, authentication, Windows/Linux, phishing, credential abuse, persistence, C2, and exfiltration.
- Query/interpret SIEM, EDR, or comparable data; correlate times, accounts, hosts, IPs, and authentication outcomes; explain telemetry limitations.
- Use intelligence/research tools for indicator enrichment/validation, infrastructure research, and source attribution; equivalent tools accepted.
- Write concise assessments and brief technical/nontechnical audiences with judgments, mission relevance, confidence, and actions.
- Collaborate with SOC, hunting, detection, or IR staff to produce investigative leads, defensive recommendations, or testable hunt hypotheses.
- Protect sensitive data; follow classification/dissemination rules; maintain reproducible notes and incorporate peer review.
Preferred:
- Three or more years of direct CTI experience, including independently producing finished intelligence and supporting operational consumers.
- Experience developing priority intelligence requirements, collection plans, actor or campaign profiles, and stakeholder feedback processes.
- Experience with Recorded Future, ThreatConnect, MISP, OpenCTI, Analyst1, or comparable platforms, including indicator quality, enrichment, provenance, and lifecycle management.
- Experience with Splunk SPL, Elastic query languages, Microsoft KQL, or comparable query languages to correlate external intelligence with internal telemetry.
- Experience applying structured analytic techniques and frameworks such as the Diamond Model, Cyber Kill Chain, or Pyramid of Pain to specific analytical problems.
- Experience supporting hypothesis-driven threat hunts using PEAK or a comparable structured methodology; ability to identify required data and document findings and limitations.
- Experience translating adversary behaviors into detection requirements or contributing to Sigma, YARA, Snort, Suricata, or platform-specific detection content, with an understanding of validation and false positives.
- Ability to use Python, PowerShell, Bash, APIs, JSON, or regular expressions for enrichment, data normalization, research, or reporting automation.
- Knowledge of STIX/TAXII and intelligence sharing practices, including appropriate Traffic Light Protocol handling and source restrictions.
- Experience analyzing threats involving Microsoft 365, Entra ID, AWS, Azure, or comparable cloud and identity environments.
- Knowledge of malware triage, sandbox reports, network forensics, and attacker infrastructure analysis sufficient to support CTI assessments.
- Experience prioritizing vulnerabilities using exploitation evidence, affected assets, exposure, mission relevance, and available controls.
- Relevant credentials such as GCTI, GCIH, GCIA, CySA+, CISSP, CTIA, or comparable formal intelligence training. These are examples of relevant development and do not independently establish contract compliance.
Benefits at Sentar:
Our unique employee ownership model attracts top talent, giving employees the freedom to take initiative and drive meaningful improvements. In addition to cultivating a thriving and inclusive work environment, Sentar offers an extensive benefits package designed to support the well-being of employees and their families. Employee ownership is the foundation of our culture, promoting participation, teamwork, and accountability while ensuring long-term financial security and a commitment to excellence.
- Voluntary Medical, Dental, Vision, with Flexible Spending Plan options
- Voluntary Life, Critical Illness, Accident, and Long Term Care insurance options
- Group Term Life, Short-Term and Long-Term Disability is provided by Sentar to all qualifying employees
- Generous 401(k) match
- Competitive PTO plan that graduates quickly with years of service
- Other leave programs; holiday schedule along with bereavement, maternity, jury and military duty
- Tuition reimbursement
- Professional development reimbursement
- Recognition and Awards programs
If you are not ready to apply for this position, submit your resume here to join our talent community. We'll keep you updated occasionally on new job opportunities.
Sentar is an Affirmative Action and Equal Opportunity Employer M/F/Vets/Persons with Disabilities
Our culture is one of inclusivity and support. Sentar is proudly an Equal Opportunity and VEVRAA Federal Contractor Employer M/F/Vets/Persons with Disabilities. Follow these links to learn more about your rights: EEO Is the Law Poster; EEO Is Law Supplement; and Pay Transparency.
We want you to build your career at Sentar, so if you are an individual with a disability and require a reasonable workplace accommodation applying for a job or at any point in the employment process, contact the Recruiting Manager at recruiting@sentar.com. Please indicate the specifics of the assistance needed. Thank you for considering Sentar in your employment search.
Build, Innovate, Secure Your Career at Sentar.