Tier 3 Cyber Threat Intelligence Analyst (CTI)

Job Description

Central Strategies is seeking a Tier 3 Cyber Threat Intelligence Analyst to support a highly visible cybersecurity single-award IDIQ vehicle providing Network Operations Security Center (NOSC) support, cyber analysis, and application development.

This role supports a Department of Homeland Security (DHS) program responsible for monitoring, detecting, analyzing, mitigating, and responding to cyber threats across the enterprise. The NOSC coordinates detection and response activities across component SOCs using centralized tracking and communication systems.

The analyst will identify, track, and investigate high-priority threat campaigns and malicious actors, bringing deep expertise in cyber threat intelligence, adversary tactics, techniques, and procedures (TTPs), and the broader threat landscape.

Basic Qualifications

• Active Top Secret/SCI Clearance
• Bachelor’s + 12 years or Master’s + 10 years in IT-related field
• Minimum 7 years as a Tier III cyber analyst performing intelligence analysis and technical analysis
• Experience with host-based and network-based monitoring tools, including signature/content development
• Ability to develop and deliver CTI reports to leadership and stakeholders
• Experience supporting incident response and threat hunting activities
• Strong capability in correlating intelligence sources for indicators, attribution, and mitigation strategies
• Experience in forensics, intrusion detection, malware analysis, and intelligence-driven detection
• Deep understanding of Pyramid of Pain, Cyber Kill Chain, MITRE ATT&CK, and the Diamond Model
• Ability to enrich intelligence with internal data (Splunk, Analyst1, etc.)
• Strong communication skills

Preferred Qualifications

• One or more certifications: CASP+ CE, CCNP-Security, CISSP (or Associate), GCED, GCIH, CCSP
• SANS GCTI
• Prior DoD, IC, or law enforcement intelligence experience
• Knowledge of Structured Analytic Techniques
• Scripting skills (Python, Bash, VB, PowerShell)
• Experience with tools such as CrowdStrike Falcon, Tanium, Proofpoint TAP, Zscaler