{"id":746516,"url":"https://alion.io/job/ai2cyber-cyber-threat-intelligence-cti-analyst","title":"Cyber Threat Intelligence (CTI) Analyst","company":{"id":8338,"name":"Ai2Cyber","domain":"ai2cyber.com","url":"https://alion.io/company/ai2cyber","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":89,"open_postings":14,"ghost_share":0,"stale_share":0.429,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Athens, Greece"],"countries":["GR"],"hiring_countries":["GR"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":35000,"max_usd":80000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Splunk","optional":false},{"name":"STIX","optional":false},{"name":"TAXII","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-08-13T00:00:00Z","employer_posted_date":"2026-08-13","last_verified_at":"2026-11-04T12:06:11Z","board_verified":true,"closed_at":null,"days_open":83,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":83},"description":"Level: Senior / Expert\nWe are seeking a highly skilled Cyber Threat Intelligence (CTI) Analyst based in Greece to join our Threat Intelligence team.\nThe ideal candidate is technically strong, analytically rigorous, and deeply familiar with adversary tradecraft. This role goes beyond monitoring feeds. You will analyze adversary behavior, correlate multi-source intelligence, map activity to MITRE ATT&CK, and produce actionable intelligence that drives detection engineering, incident response, and strategic security decisions. You will operate at the intersection of intelligence analysis, detection engineering, and adversary emulation.\nResponsibilities\nStrategic & Tactical Intelligence\nAnalyze threat actor activity, campaigns, malware families, and TTP evolution.\nProduce actionable intelligence reports for SOC, IR, and leadership.\nConduct threat landscape assessments and sector-specific risk analysis.\nTrack and profile APT groups, financially motivated actors, and emerging threats.\n Technical Analysis\nExtract and correlate IOCs (domains, IPs, hashes, infrastructure patterns).\nMap adversary techniques to MITRE ATT&CK.\nAnalyze malware behavior reports and sandbox outputs.\nReview PCAPs, logs, and telemetry to identify patterns and anomalies.\nSupport detection rule development (Sigma, YARA, Splunk, EDR queries).\n Intelligence Engineering & Automation\nWork with STIX/TAXII feeds and threat intelligence platforms.\nAssist in automation of ingestion, normalization, and correlation pipelines.\nContribute to intelligence scoring models (risk scoring, actor confidence, exploit maturity).\nValidate intelligence through internal telemetry and honeypot data (if applicable).\nCross-Team Collaboration\nSupport SOC during active investigations.\nProvide adversary insights during incident response.\nContribute to purple-team exercises and threat emulation scenarios.\nPresent findings to technical and executive stakeholders.\nRequired Technical Skills\nStrong understanding of:\nAdversary TTPs\nKill Chain & MITRE ATT&CK framework\nIOC lifecycle & enrichment techniques\n Experience with:\nThreat Intelligence Platforms (TIPs)\nMalware analysis reports\nLog analysis (Splunk, ELK, etc.)\nOSINT collection techniques\n Knowledge of:\nSTIX/TAXII\nYARA / Sigma rule creation\nNetwork protocols & traffic analysis\nWindows & Linux security telemetry\nScripting capability (Python preferred) for data processing and automation.\nPreferred / Advanced Qualifications\nExperience tracking specific threat actors (APT28, Lazarus, FIN7, etc.)\nFamiliarity with exploit development trends and CVE weaponization timelines\nExperience with honeypots and telemetry-driven intelligence\nUnderstanding of ransomware ecosystems & initial access brokers\nKnowledge of ML-assisted threat detection (bonus)\nAnalytical & Soft Skills\nStrong hypothesis-driven analytical thinking\nAbility to differentiate noise from signal\nClear technical writing skills\nAbility to brief senior leadership concisely\nOperational security awareness\nNice to Have Certifications\nGIAC (GCTI, GCIA, GCED)\nOSCP / OSCE\nCISSP\nSANS CTI-related certifications\nBenefits\nHighly competitive salary reviewed upwards on a regular basis.\nWorking from home: Hit your goals from the comfort of your home because we value performance, not the place.\nParticipation in state-of-the-art project and tech challenges and participation in large-scale projects.\nPersonal and professional development, amongst industry experts and talented people.\nContinuous learning, having access to board resources.\nOnboarding plan and training so that you have a smooth induction and feel confident and ready to take over your new role.\nEquipment support so you have all the tools to do effectively and efficiently your work.\nNo dress code as we want you to be as comfortable as possible.\nAt AI2CYBER, we are a cybersecurity firm dedicated to providing cutting-edge solutions to protect businesses and individuals from evolving cyber threats. Our mission is to empower organisations to navigate the complex cybersecurity landscape with confidence. We believe that by combining robust security solutions, continuous improvement, and a proactive mindset, we can help our clients stay one step ahead of cyber attackers. We are committed to building a safer digital world and are passionate about making a positive impact in the industry.\nThis is a full-time position with competitive salary and benefits. If you have a passion for cyber threat intelligence and are looking for an exciting opportunity to work with cutting-edge technology, we would love to hear from you!\nNote: All applications will be treated with strict confidentiality.\nTo apply, please send us your CV at \nRequirements\nThis position in available only for Greek residents.","description_format":"text","description_chars":4760,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"master","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Professional development"],"hiring_locations":[{"name":"Greece","iso":"GR","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-09-11T14:21:38Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.499,"p_room":0.28,"age_days":83,"expected_fill_days":29,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/ai2cyber-cyber-threat-intelligence-cti-analyst","json_url":"https://alion.io/job/ai2cyber-cyber-threat-intelligence-cti-analyst.json","meta":{"generated_at":"2026-11-04T15:16:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":23215,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8338},"rest":"https://alion.io/mcp/rest/get_company?id=8338"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fai2cyber-cyber-threat-intelligence-cti-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fai2cyber-cyber-threat-intelligence-cti-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fai2cyber-cyber-threat-intelligence-cti-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ai2cyber-cyber-threat-intelligence-cti-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fai2cyber-cyber-threat-intelligence-cti-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":746516}},{"tool":"search_jobs","arguments":{"company":"ai2cyber.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":746516},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}