Threat Intelligence Lead

The Company

Every day, NuHarbor Security improves the cybersecurity of our clients by making it stronger and easier to understand. Our comprehensive suite of security services, from strategic advising to 24‑hour monitoring and management, provide an organizational view of security that is focused on results and recommendations that are valuable for both business and technical leaders. We're growing quickly because our clients, and the general market, are looking for these outcomes and for the data it gives them to explain, promote, and justify, their security investment and mission.

The Threat Intelligence Lead is critical in proactively searching for indicators of compromise (IOCs) and indicators of attack (IOAs) and actively hunting for threats not yet formally categorized by a threat actor. This position Operator is expected to collaborate with Detection Engineering teams to refine detection capabilities, identifying emerging threats and developing and implementing detection strategies and methodologies. The Operator also holds the critical role in directly working with Clients to provide feedback, recommendations, and provide remediation guidance as needed.

• Live by the NuHarbor corporate values:
  Help Clients Win, Always Improve, Protect the House.
• Conduct client directed proactive investigations to identify cyber threats, advanced persistent threats, and anomalous activity within enterprise networks and endpoints.
• With a focus on client environments and desired outcomes, research new and existing threat actors and associated tactics, techniques, and procedures (TTPs); developing a detailed understanding of their potential impact on the client.
• Perform deep‑drive analysis of suspected security incidents to determine impact, risk, and response actions.
• Lead and manage threat research initiatives to assess emerging threats and vulnerabilities, and correlate adversary activities, attack chains, and artifacts to provide threat intelligence that supports the timely detection of active threats.
• Identify and propose automated detections for new and previously unknown threats. Collaborate with NuHarbor internal and external Cyber organizations to mitigate risk by testing, deploying, and developing investigative playbooks.
• Produce and disseminate timely, actionable, and relevant threat intelligence to detection engineering to inform NHS' detection package based on relevant threats to NuHarbor's client base.
• Develop and deliver finalized threat intelligence to the SOC that directs intelligence‑driven threat hunting efforts and convert results into actionable intelligence that can inform the adjustment of existing detections and the creation of new detections.
• Lead threat intelligence requirement development and intelligence delivery (tactical, operational, and strategic) across all applicable NuHarbor stakeholders.
• Lead the management, maintenance, and general administration of NuHarbor's threat intelligence tooling, infrastructure, Threat Intel Platform (TIP), threat feeds, and threat information sharing efforts.
• Work with Managed Services and Client Success to deliver high priority situational awareness/intelligence to the NuHarbor client based in response to emergent threats while collaborating with detection engineering to provide timely solutions.
• Act as a centralized point for threat hunters and red team to collaborate with when researching emerging threats that provide opportunities to address detection gaps.

• Bachelor's Degree and five (5) years of experience. Experience should be in a cybersecurity field and should include relevant industry certifications.
  • In lieu of a degree, two (2) years of experience in a related technology field and relevant industry certifications are required.
• Two (2) or more years of experience in a threat analyst role.
• A minimum of two (2) years of experience with OSINT and threat hunting.
• A minimum of one (1) year of experience using Splunk and or other SIEM technologies.
• Demonstrated expertise in intelligence tradecraft, the intelligence lifecycle, common threat modeling frameworks:
  • MITRE ATT&CK
  • Diamond Model
  • PEAK
  • C…