Cyber Threat Intelligence Analyst

The Cyber Threat Intelligence Analyst will lead the collection, analysis and dissemination of cyber threat intelligence to anticipate risks and strengthen the resilience of Judiciary institutions within the BRA/25/025 project. The role involves coordination with CNJ and UNDP teams and supporting cybersecurity efforts for the Brazilian Judiciary.

Responsibilities

• Engage in the threat information-sharing network among Judiciary bodies, ensuring the smooth flow of tactical and operational data.
• Produce intelligence inputs for operational alerts, threat advisories, and rapid dissemination bulletins for technical teams and managers.
• Facilitate cooperation with national and international Computer Security Incident Response Teams (CSIRTs) and public sector cooperation networks.
• Contribute to a proactive, forward-looking cyber defense posture for the Judiciary, anticipating threats based on the intelligence produced and shared.
• Support the operation and curation of intelligence-sharing platforms (e.g., MISP, OpenCTI), using standards such as STIX/TAXII and the Traffic Light Protocol (TLP) for the classification and dissemination of information.
• Conduct advanced analyses of threat actors, their motivations, capabilities and TTPs (Tactics, Techniques and Procedures), applying analytical models such as the Diamond Model and the Cyber Kill Chain.
• Transform raw data from technical, open and internal sources into actionable intelligence to support proactive defense and improve incident containment, observing operational security (OPSEC) best practices in collection activities.
• Support vulnerability prioritization based on the actual likelihood of exploitation in the current threat landscape.
• Monitor open sources, forums, deep and dark web channels, and national and international technical reports to identify campaigns, data leaks and threats targeting the public sector and the Judiciary.
• Define, maintain and periodically review Priority Intelligence Requirements (PIRs), ensuring intelligence production remains aligned with organizational risks, priorities and the evolving threat landscape.
• Produce and provide indicators of compromise (IoCs), behavioral patterns and detection signatures/rules (e.g., YARA, Sigma, Snort/Suricata) to feed monitoring systems (SIEM, EDR, IDS/IPS, etc.).
• Collaborate with Blue Team, Threat Hunting and Incident Response teams to validate intrusion hypotheses based on threat intelligence.
• Assess the effectiveness of security coverage against techniques mapped in frameworks such as MITRE ATT&CK, identifying detection gaps and proposing adjustments.
• Support the automation and orchestration of intelligence workflows (collection, enrichment, correlation and distribution), integrating CTI platforms with SOAR and monitoring tools.
• Support the analysis of incident-related artifacts, logs and relevant technical evidence to extract relevant IoCs and TTPs.
• Contribute to periodic security posture reviews with an external view of threats specifically targeting the public sector and the Judiciary.
• Identify long-term cyberattack trends to guide investments and changes in the defense architecture.
• Propose improvements to technical controls based on the evolution of identified threats.
• Support External Attack Surface Management (EASM) activities by identifying exposed assets, leaked credentials and indicators of organizational exposure.
• Integrate real-world threat intelligence into Situational Awareness programs to raise user maturity against targeted attacks.
• Promote the use of CTI frameworks (e.g., MITRE ATT&CK, Diamond Model, Cyber Kill Chain), OPSEC best practices and security data analysis.
• Participate in the development of realistic threat scenarios for crisis simulation exercises and continuity plans.
• Produce technical intelligence reports, threat assessments, and executive summaries tailored to technical teams and senior management.
• Conduct workshops and training on intelligence analysis for local teams.
• Document analysis methodologies and lessons learned from relevant incidents, and keep the knowledge base on sector adversaries up to date.
• Develop and maintain analytical templates, reporting standards and intelligence production guidelines to ensure consistency across the intelligence lifecycle.
• Promote the reuse of intelligence products across Incident Response, Threat Hunting, Vulnerability Management and Security Operations teams

Requirements

• Advanced university degree (Master’s degree or equivalent) in Information Security, Information Technology, Information Systems, Computer Science, Computer Engineering, Software Engineering, Telecommunications Engineering, Electrical Engineering or related fields is required, or a first-level university degree (Bachelor’s degree) in the areas mentioned above, in combination with an additional two years of qualifying experience will be given due consideration in lieu of the advanced university degree.
• Applicants with Master’s degree (or equivalent) in a relevant field of study are not required to have professional work experience.
• Applicants with a Bachelor’s degree (or equivalent) are required to have a minimum of two (2) years of experience in Cyber Threat Intelligence.
• Recognized complementary training in CTI, OSINT, OPSEC, digital forensics or related areas.
• Previous experience in a Security Operations Center (SOC), CSIRT/CERT or dedicated threat intelligence team, preferably in the public sector or the justice system.
• Experience in collecting and analyzing open-source intelligence and in using cyber threat intelligence platforms (e.g., MISP, OpenCTI).
• Experience using scripting and query languages (e.g., Python, KQL, SPL) for collecting, parsing and analyzing large volumes of security data.
• Experience in writing technical and executive reports on cyber threats.
• Experience with the Brazilian legal and regulatory framework on cybersecurity and data protection.
• Fluency in Portuguese is required.
• Fluency in English is desirable.

Skills

• Cyber Threat Intelligence
• Open-Source Intelligence Research
• Operational Security (OPSEC)
• Digital Forensics
• Security Operations Center
• CSIRT
• CERT
• Threat Intelligence Platforms
• MISP
• OpenCTI
• Python Scripting
• KQL Query Language
• SPL Query Language
• Security Data Analysis
• Technical Report Preparation
• Executive Report Writing
• Cybersecurity Legal Framework
• Data Protection Regulations
• Portuguese Language
• English Language

Languages

Portuguese, English