Cyber Intelligence Analyst

If you are motivated and believe in the credit union philosophy of "People Helping People," join our team!

You will turn external threat reporting and internal telemetry into actionable intelligence, build and tune detections in Splunk, and help drive the shift from reporting on vulnerabilities toward reducing real exposure. Your analysis directly informs prioritization for the vulnerability management program, the detections that protect the enterprise, and the threat briefings that reach the CISO and executive leadership.

This is a hands-on role. You will spend as much time writing SPL and correlation searches as you will reading threat reports, and you will be expected to close the loop between the two.

What you will do

Threat intelligence and analysis

• Collect, analyze, and operationalize threat intelligence from commercial feeds, ISACs, open sources, and vendor advisories.
• Track threat actors, campaigns, malware families, and TTPs relevant to our industry, technology stack, and third-party ecosystem, mapping findings to MITRE ATT&CK.
• Produce clear, decision-ready intelligence products: tactical indicator packages, operational campaign analysis, and strategic briefings for leadership.
• Assess the exploitability and real-world relevance of newly disclosed vulnerabilities (CISA KEV, EPSS, vendor advisories, exploit availability) and feed that assessment into vulnerability prioritization.
• Support incident response with threat context, attribution analysis, and indicator enrichment.
  
  

Detection engineering

• Design, build, test, and tune detections in Splunk Enterprise Security, including correlation searches, risk-based alerting (RBA) rules, and notable event logic.
• Translate intelligence on adversary TTPs into detection coverage; maintain a coverage map against MITRE ATT&CK and identify gaps.
• Write efficient, maintainable SPL; build and maintain lookups, macros, data models, and CIM-compliant normalization for new data sources.
• Own the detection lifecycle: hypothesis, development, validation against test data or purple-team exercises, deployment, tuning, and retirement.
• Reduce false positives and alert fatigue through measurement and iterative tuning.
  
  

Threat hunting and exposure management

• Conduct hypothesis-driven threat hunts across Splunk and endpoint, network, identity, and cloud telemetry.
• Correlate vulnerability data (Tenable) with endpoint (SentinelOne), source control (GitHub), network and edge (F5, Check Point, Zscaler), and email (Proofpoint) telemetry to surface exposed, exploitable, and actively targeted assets.
• Contribute to the continuous threat exposure management (CTEM) program by aligning threat intelligence with asset context and business impact.
• Support emerging programs in AI security, supply chain / third-party risk, and application security with threat research and detection use cases.
  
  

Reporting and collaboration

• Build and maintain Splunk dashboards and scheduled reports for threat intelligence metrics, detection coverage, and hunt outcomes.
• Partner with the Splunk platform team on data onboarding, search performance, and platform changes.
• Work closely with vulnerability management, incident response, IT operations, and application owners to drive remediation and detection improvements.
• Brief technical and non-technical audiences, including contributions to CISO and governance-level reporting.
  
  

What you bring

Required

• 4+ years in cybersecurity with at least 2 years focused on threat intelligence, detection engineering, threat hunting, or SOC analysis.
• Strong hands-on Splunk experience: advanced SPL, Splunk Enterprise Security, correlation searches, risk-based alerting, data models, and CIM.
• Demonstrated experience building and tuning detections from threat intelligence or adversary emulation.
• Working knowledge of MITRE ATT&CK and the ability to apply it to both intelligence analysis and detection coverage.
• Solid understanding of attacker tradecraft across endpoint, network, identity, cloud, and email.
• Familiarity with vulnerability management data and prioritization frameworks (CVSS, VPR, EPSS, CISA KEV).
• Strong analytical writing; able to produce concise intelligence products for audiences ranging from engineers to executives.
  
  

Preferred

• Experience with Tenable, SentinelOne, GitHub Advanced Security, Zscaler, Proofpoint, or comparable platforms.
• Scripting in Python for enrichment, automation, or data analysis; familiarity with APIs and STIX/TAXII.
• Experience with a threat intelligence platform (TIP) and with structured analytic techniques.
• Exposure to CTEM or exposure management platforms.
• Experience with detection-as-code practices (version control, testing, CI/CD for detections).
• Relevant certifications such as GCTI, GCDA, GCFA, Splunk Core Certified Power User or Enterprise Security Certified Admin, or CySA+.
• Background in AI/ML security, software supply chain security, or application security.
  
  

SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.

Disclaimer

State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.