Job Description

Job Title - Threat Intelligence Analyst (L2)

Location - India (Hybrid)

Role Level L2 – Advanced Operations / Intelligence Analysis / Incident Support

Role Summary

 The L2 Threat Intelligence Analyst is responsible for advanced analysis, enrichment, and operational use of cyber threat intelligence to support security operations and incident response activities across enterprise environments.

This role handles threat intelligence alerts and requests, performs deeper contextual analysis using Talos and Recorded Future, supports incident investigations with intelligence insights, and escalates strategic or complex intelligence.

In Scope Threat Intelligence Platforms

• Cisco Talos

• Recorded Future

Key Responsibilities (L2)

L2 Threat Intelligence Analysis & Enrichment

• Analyze threat intelligence alerts, feeds, and reports

• Perform contextual enrichment of indicators of compromise (IOCs), including:

o IP addresses

o Domains and URLs

o File hashes

o Threat actors and malware families

• Validate intelligence relevance and confidence before use in investigations. Intelligence Support for Security Incidents

• Support SOC, IR, and security operations teams by providing actionable threat intelligence during active incidents.

• Correlate Talos and Recorded Future intelligence with:

o Network and endpoint alerts

o Email security findings 

o Cloud and infrastructure security events

• Help assess threat severity, likelihood, and potential impact.

Threat Monitoring & Trend Analysis (L2) 

• Monitor intelligence sources for:

o Emerging threats

o Campaign activity

o Exploited vulnerabilities

o Industry relevant threat trends

• Identify patterns and recurring indicators that may indicate broader attack campaigns.

• Escalate high risk or novel threat activity to Client Incident Response Teams Use Case and Detection Support

• Provide intelligence input to improve:

o SIEM/SOC detection use cases

o Alert prioritization and triage decisions

• Support tuning initiatives by validating IOC quality and reducing false positives.

Reporting & Documentation

• Document intelligence assessments clearly in tickets, reports, or case notes.

• Produce operational intelligence summaries for shift handovers and incident reviews.

• Adhere to SLAs, SOPs, and escalation procedures.

Required Skills & Experience Mandatory

• 3–6+ years experience in Threat Intelligence, SOC, or Security Operations roles

• Hands on operational experience with: o Cisco Talos o Recorded Future

• Strong understanding of:

o Cyber kill chain and attack lifecycle 

o Common threat actor TTPs

o Malware and vulnerability exploitation concepts Preferred

• Experience supporting SOC or incident response teams with threat intelligence

• Familiarity with MITRE ATT&CK framework

• Experience in managed security services or large enterprise SOCs Certifications (Preferred / Nice to Have)

• Threat intelligence or SOC focused certifications

• Security+ / CySA+ or equivalent

• Any vendor neutral threat intelligence training

͏

Areas of responsibility

Monitoring and Incident Detection-Handle escalated alerts, prevent potential intrusions from third party agents and analyse log correlation to ensure alignment with security standards.

Incident Handling and Analysis-Triage security incidents, handle escalated incidents, assist in performing root cause analysis and prepare reports that adhere to compliance requirements.

Threat Assessment and Analytics-"Perform vulnerability scans, identify threat intelligence feeds, and recommend preventive measures to reduce exposure."

Stakeholder Coordination and Audit Assistance-Coordinate with internal teams on security issues, maintain risk registers and assist during compliance audits.

͏

͏

͏