Threat Intelligence Lead with MITRE ATT&CK (W2 Contract)

Hi,

I hope you’re having a great day!

I’m Naved from the Cyber 1 Armor Inc. We currently have a new opportunity with one of our clients that I believe could be a good fit. If you’re interested, please share your updated resume along with your expected pay rate.

I’ve included the job details below—please let me know your thoughts.

Job Title: Threat Intelligence Lead with MITRE ATT&CK

Location: Irving, TX 75063 (Fully Onsite)

Duration: 12 Months Contract (Can be extended)

Interview process: Teams

Job description:

• You own the threat intelligence function, setting collection priorities, intelligence standards, and reporting cadence for the organization.
• You lead a team of analysts, direct their day-to-day work, and are personally accountable for the quality, timeliness, and actionability of intelligence delivered to Security Operations, Incident Response, Vulnerability Management, and executive stakeholders.
• You represent threat intelligence in leadership forums, own vendor and feed decisions, and build the program's maturity year over year.

Key Responsibilities:

Lead the threat intelligence program:

• Set intelligence collection priorities and requirements based on organizational risk, industry targeting, and stakeholder needs
• Own the threat intelligence roadmap, including program maturity, tooling, staffing, and process improvements
• Establish and enforce standards for finished intelligence products, source reliability, and confidence-level reporting
• Define and track program KPIs, such as report timeliness, actionability, detection coverage, and stakeholder satisfaction

Manage and develop the analyst team:

• Hire, coach, and manage threat intelligence analysts, including workload prioritization and quality review of their work
• Set individual and team goals, conduct performance reviews, and build career development plans for analysts
• Run the team's intelligence cycle end to end: tasking, collection, analysis, production, and dissemination
• Build team proficiency in structured analytic techniques, adversary tracking, and the MITRE ATT&CK framework

Deliver strategic and operational intelligence:

• Personally author and quality-check high-stakes intelligence products, including executive and board-level briefings
• Lead intelligence support during major incidents, providing attribution, actor intent, and containment guidance to IR leadership
• Direct the organization's threat landscape assessment, including sector-specific and geopolitical risk
• Prioritize vulnerability remediation guidance in partnership with Vulnerability Management using exploitation and actor-interest data

Own detection enablement and adversary emulation:

• Partner with detection engineering to convert intelligence into SIEM/EDR detection logic and hunting programs
• Direct threat-informed red team, purple team, and adversary emulation exercises using current TTPs
• Review and approve detection and hunting priorities to ensure they reflect the current threat landscape

Vendor, platform, and cross-functional leadership:

• Own the threat intelligence platform (TIP) strategy, feed and vendor selection, licensing, and renewal decisions
• Build and maintain relationships with industry ISACs/ISAOs, law enforcement, and peer intelligence leads for information sharing
• Represent threat intelligence in leadership, risk, and governance forums, including budget and staffing discussions
• Partner with Security Architecture, IR, Vulnerability Management, and Product Security leads to align intelligence with broader security strategy

Expectations:

• Occasional after-hours support may be required.
• Set the team's quarterly collection priorities based on a shift in the organization's threat landscape or business footprint
• Lead intelligence support for a major incident, briefing executive leadership on likely actor, objectives, and containment status
• Negotiate and onboard a new commercial threat intelligence feed, defining success metrics before renewal
• Review and elevate an analyst's actor profile before it goes to the CISO and board
• Direct a purple team exercise built around a threat actor actively targeting the organization's sector

Years of Experience:

• 6 years of experience in threat intelligence, security operations, or incident response, including prior experience mentoring or leading analysts

Required Qualifications (Non-Negotiable):

• Deep working knowledge of MITRE ATT&CK, the intelligence cycle, and structured analytic techniques
• Demonstrated experience producing and delivering intelligence to executive and board-level audiences
• Experience directing threat intelligence platform and vendor strategy, including feed evaluation and management
• Experience partnering with detection engineering, incident response, and vulnerability management on intelligence-driven prioritization
• Strong people-leadership skills, including hiring, coaching, and performance management of analysts
• Excellent written and verbal communication skills, with the ability to translate technical findings into business risk
• Sound analytic judgment, including the ability to state and defend confidence levels under scrutiny
• Bachelor's degree in Cybersecurity, Computer Science, Intelligence Studies, or related field, or equivalent experience

Nice-to-Have Qualifications (Desired but Not Required):

• Threat Intelligence Platforms (TIPs): MISP, ThreatConnect, Anomali, Recorded Future
• SIEM/SOAR: Splunk, Palo Alto Cortex XSOAR
• Malware and sandbox analysis: VirusTotal, Any.Run, Hybrid Analysis, Joe Sandbox
• Frameworks: MITRE ATT&CK, Diamond Model, Cyber Kill Chain, Traffic Light Protocol (TLP)
• OSINT and dark web tooling: Maltego, Shodan, Censys, dark web monitoring services
• Vulnerability and exposure data: CVE/NVD, EPSS, CISA KEV catalog
• Program and reporting: KPI dashboards, ticketing/workflow tools, executive reporting templates

Thank & Regards

Naved Khan

Sr. Technical Recruiter

Email: nkhan@cyber1armor.com

LinkedIn: https://www.linkedin.com/in/naved-khan-3991a442/

666 Plainsboro Rd, Suite 691, Plainsboro, NJ 08536

Website: https://cyber1armor.com/