{"id":1094812,"url":"https://alion.io/job/brookfield-senior-analyst-cyber-threat-intelligence","title":"Senior Analyst – Cyber Threat Intelligence","company":{"id":3728,"name":"Brookfield","domain":"brookfield.com","url":"https://alion.io/company/brookfield","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":13,"ghost_share":0,"stale_share":0.769,"repost_share":0,"time_to_fill_p50_days":48,"computed_at":"2026-11-11T05:49:22Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Toronto, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":71000,"max_usd":133000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":53},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"Diamond Model","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"NIST AI RMF","optional":true},{"name":"SIEM","optional":true},{"name":"STIX","optional":true},{"name":"TAXII","optional":true}],"status":"live","first_seen_at":"2026-09-21T17:13:07Z","employer_posted_date":"2026-09-21","last_verified_at":"2026-11-11T10:11:31Z","board_verified":true,"closed_at":null,"days_open":51,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":51},"description":"Location\nBrookfield Place - 181 Bay StreetTechnology Services\nTechnology Services (TS) is responsible for delivering all enterprise infrastructure, applications and related end user technology services across all Brookfield business groups.\nBrookfield Culture\nBrookfield has a unique and dynamic culture. We seek team members who have a long-term focus and whose values align with our Attributes of a Brookfield Leader: Entrepreneurial, Collaborative and Disciplined. Brookfield is committed to the development of our people through challenging work assignments and exposure to diverse businesses.\n Job Description\nThe Senior Security Analyst - Cyber Threat Intelligence is responsible for monitoring, investigating, and assessing emerging cyber threats across the open, deep, and dark web to identify risks that may affect Brookfield, its employees, executives, clients, portfolio companies, technology environment, brand, or critical business operations. This role combines threat intelligence analysis, cybercrime research, dark web monitoring, investigative research, and intelligence reporting to deliver proactive, Brookfield-specific threat visibility. The Senior Analyst works closely with Security Operations, Incident Response, Vulnerability Management, Legal, Privacy, and Fraud teams to translate external threat activity into actionable security and business outcomes.\nKey Responsibilities\nMonitor cybercriminal ecosystems across the dark web, underground forums, marketplaces, messaging platforms, paste sites, and leak sites for activity targeting Brookfield, its executives, employees, portfolio companies, brands, domains, and technology environment.\nIdentify and track threat actors, ransomware groups, initial access brokers, malware operators, fraud networks, and criminal collectives relevant to Brookfield's industry, profile, and operations.\nResearch and investigate stolen credentials, compromised accounts, data leaks, ransomware activity, initial access sales, vulnerability exploitation, malware campaigns, phishing operations, business email compromise, and fraud schemes.\nCollect, validate, enrich, and analyze intelligence from OSINT, commercial intelligence sources, internal security data, and specialized cybercrime sources; assess source credibility and distinguish credible threats from speculation and criminal posturing.\nDevelop and maintain threat actor profiles covering motivations, capabilities, tactics, techniques, and procedures (TTPs), infrastructure, targeting patterns, and historical activity.\nCorrelate dark web intelligence with internal telemetry, security events, threat intelligence feeds, vulnerability information, and publicly available intelligence.\nMap adversary activity to MITRE ATT&CK and other analytical frameworks; identify indicators of compromise (IOCs), adversary infrastructure, domains, IP addresses, cryptocurrency addresses, and other intelligence artifacts.\nProduce concise, actionable intelligence reports, threat assessments, executive briefings, and tactical alerts for technical and non-technical audiences.\nSupport Security Operations and Incident Response teams with external threat context during active investigations, ransomware events, data breaches, fraud cases, and third-party compromises.\nInvestigate potential exposure of corporate credentials, sensitive data, intellectual property, customer information, and employee information across underground sources.\nValidate claims made by threat actors regarding alleged data theft or compromise through appropriate intelligence sources.\nMonitor and assess the use of artificial intelligence by threat actors, including AI-enabled phishing, business email compromise, executive impersonation, deepfakes, synthetic identities, disinformation, malware development, and automated reconnaissance.\nInvestigate suspected synthetic media and AI-generated content using appropriate technical, contextual, and intelligence-validation methods; communicate confidence levels and analytical limitations clearly.\nUse approved AI tools to support intelligence collection, translation, analysis, summarization, and reporting while protecting sensitive information and independently validating material conclusions.\nDevelop and maintain repeatable processes for dark web monitoring, threat actor tracking, intelligence collection, source validation, investigative research, and escalation.\nMaintain intelligence records, threat actor dossiers, watchlists, case notes, and documented evidence in accordance with legal, privacy, and operational-security requirements.\nParticipate in a scheduled information security on-call rotation and provide time-sensitive intelligence support during significant incidents, including ransomware claims, credential exposure, data leaks, executive threats, active exploitation, and third-party compromise.\nKey Deliverables\nContinuous dark web and underground monitoring, with credible threats identified and escalated within defined timelines.\nCurrent threat actor profiles for groups relevant to Brookfield's industry and risk profile.\nIntelligence reports and executive briefings produced on a regular cadence and delivered to security leadership and relevant stakeholders.\nCredential exposure and data leak investigations completed, with findings documented and remediation actions tracked.\nIOCs and threat intelligence artifacts delivered to Security Operations and Incident Response teams in support of active investigations.\nRepeatable intelligence collection and monitoring processes documented and continuously improved.\nThreat intelligence integrated with internal telemetry to improve detection and response capabilities.\nMaterial AI-enabled threats assessed and communicated through timely tactical alerts or executive intelligence reporting.\nCritical intelligence identified outside regular business hours validated, documented, and escalated within established response targets.\nRequired Experience\nThree to seven years of experience in cyber threat intelligence, cyber investigations, SOC operations, incident response, digital forensics, or security research.\nDemonstrated experience researching cybercrime activity and dark web or underground ecosystems.\nExperience conducting OSINT and investigative research using multiple sources and analytical techniques.\nStrong understanding of threat actor behavior, cybercrime business models, common attack methodologies, and the broader threat landscape.\nExperience producing intelligence reports and briefings for technical and executive audiences.\nExperience supporting time-sensitive investigations or incidents and working within defined escalation procedures.\nSkills & Qualifications\nStrong analytical and investigative mindset, with the ability to evaluate source credibility and distinguish fact from speculation.\nAbility to translate complex technical findings into concise, actionable intelligence for technical and non-technical stakeholders.\nWorking knowledge of MITRE ATT&CK, Cyber Kill Chain, Diamond Model, or similar analytical frameworks.\nUnderstanding of IOCs, adversary infrastructure, and intelligence artifact analysis.\nStrong written and verbal communication skills, with experience producing structured intelligence products.\nAbility to work independently, manage competing priorities, and conduct investigations with appropriate discretion and operational security.\nWorking knowledge of generative AI technologies, AI-enabled threat activity, synthetic media risks, and responsible use of AI-assisted analytical tools.\nWorking knowledge of PowerShell and/or Python is an asset.\nPreferred Qualifications\nExperience tracking ransomware groups, initial access brokers, credential theft operations, data extortion groups, malware-as-a-service, or underground marketplaces.\nExperience with cyber threat intelligence platforms, dark web monitoring tools, SIEM technologies, EDR/XDR platforms, and OSINT tooling.\nUnderstanding of cryptocurrency and blockchain activity relevant to cybercrime investigations.\nFamiliarity with threat intelligence standards and formats such as STIX/TAXII.\nExperience conducting investigations involving credential exposure, ransomware, data extortion, fraud, phishing, business email compromise, or third-party compromise.\nFamiliarity with AI-security risks and recognized guidance such as the NIST AI Risk Management Framework and Generative AI Profile.\nRelevant certifications such as CTIA, GCTI, GCFA, GCIH, GCIA, CISSP, or Security+.\nPost-secondary education in cybersecurity, computer science, information security, intelligence studies, criminal justice, or a related discipline, or equivalent practical experience.\nAdditional Requirement\nThis position participates in a scheduled after-hours on-call rotation and may be required to provide timely support during significant security incidents, critical vulnerabilities, or other urgent security events.\nSalary Range: C$105K - $115K\nPosition Opening Reason:\nNew PositionBrookfield is committed to maintaining a Positive Work Environment that is safe, respectful; our shared success depends on it. We do not tolerate workplace discrimination, violence or harassment. We are proud to be an Equal Opportunity Employer and make employment decisions based on qualifications, merit, and business needs, without regard to any characteristic protected by applicable law. Applicant information is collected and handled in accordance with our Applicant Privacy Notice. As part of this commitment, we provide barrier-free and accessible employment practices in accordance with the Accessibility for Ontarians with Disabilities Act (AODA) and applicable human rights legislation. If you require a Human Rights Code-protected accommodation at any stage of the recruitment process, please let us know when contacted, and we will work with you to meet your needs.","description_format":"text","description_chars":9858,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Real Estate Investment","Private Equity"],"lifecycle":[{"event":"open","at":"2026-09-21T17:13:07Z"}],"visa":[],"liveness":{"score":25,"band":"fade","label":"Fading","p_open":1,"p_active":0.569,"p_room":0.44,"age_days":50,"expected_fill_days":48,"reasons":["conf:6","stale_co","win:tail","crowd:brand"],"computed_at":"2026-11-11T05:49:22Z"},"pay":null,"html_url":"https://alion.io/job/brookfield-senior-analyst-cyber-threat-intelligence","json_url":"https://alion.io/job/brookfield-senior-analyst-cyber-threat-intelligence.json","meta":{"generated_at":"2026-11-11T19:23:46Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":37515,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3728},"rest":"https://alion.io/mcp/rest/get_company?id=3728"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbrookfield-senior-analyst-cyber-threat-intelligence"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbrookfield-senior-analyst-cyber-threat-intelligence"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbrookfield-senior-analyst-cyber-threat-intelligence"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/brookfield-senior-analyst-cyber-threat-intelligence\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbrookfield-senior-analyst-cyber-threat-intelligence"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1094812}},{"tool":"search_jobs","arguments":{"company":"brookfield.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1094812},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}