{"id":3392518,"url":"https://alion.io/job/sita-threat-analyst","title":"Threat Analyst","company":{"id":94825,"name":"SITA","domain":"sita.aero","url":"https://alion.io/company/sitaonline","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jibe","truth_index":{"grade":"A","score":85,"open_postings":32,"ghost_share":0,"stale_share":0.594,"repost_share":0,"time_to_fill_p50_days":49,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":31000,"max_usd":58000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":34},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Diamond Model","optional":false},{"name":"Linux","optional":false},{"name":"Maltego","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"MISP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OpenCTI","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Recorded Future","optional":false},{"name":"Shodan","optional":false},{"name":"SIEM","optional":false},{"name":"SpiderFoot","optional":false},{"name":"STIX","optional":false},{"name":"TAXII","optional":false},{"name":"Windows","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-10-28T09:13:00Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-10-30T06:19:24Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"OverviewWELCOME TO THE CSIRT THREAT TEAM AT SITA\nWe’re the proactive cyber threat team responsible for keeping our airports, airlines, flying smoothly, and borders open. Our tech and communication innovations are the secret behind the success of the world’s air travel industry. You’ll find us at 95% of international hubs. We partner closely with over 2,500 transportation and government clients, each with their own unique needs and challenges. Our goal is to find fresh solutions and cutting-edge tech to make their operations run like clockwork.\nWant to be a part of something big? Are you ready to love your job? The adventure begins right here, with you, at SITA.\nABOUT THE ROLE & TEAM\nAs a Threat Analyst, you will be part of the CSIRT Threat Team within SITA’s global Enterprise Information Security Office (EISO). Our mission is simple: proactively identify threats before they become incidents - essentially, determining who is “knocking at our door”. This dual-discipline role spans both Cyber Threat Intelligence (CTI) and Threat Hunting, enabling SITA to anticipate, detect, and act on adversary activity targeting SITA, its business units, subsidiaries, its customers and the broader aviation industry.\nYou will operate within a globally distributed team spanning primarily Montreal, Singapore, and Cairo, contributing to 24/7/365 operations coverage.\nWHAT YOU’LL DO\nThreat Intelligence\n Intelligence Gathering & Analysis - Collect and analyze data from OSINT, commercial threat feeds (Recorded Future, Mandiant), Aviation-ISAC, dark web forums, law enforcement, government and internal telemetry to identify emerging threats, threat actors, and vulnerabilities relevant to SITA and the aviation sector.\n Threat Actor Profiling - Research and maintain profiles on threat actor groups (nation-state APTs, cybercriminal syndicates, hacktivists) targeting aviation, critical infrastructure, and SITA’s operations globally.\nIntelligence Dissemination - Produce and distribute intelligence products in clear, actionable formats including weekly Threat Newsletters, quarterly Threat Landscape Reports, Threat Actor Profiles, Flash Alerts, and Vulnerability & Exploit Intelligence briefs.\nDark Web & Brand Monitoring - Monitor dark web marketplaces, data leak sites, paste sites, and underground forums for threats to SITA’s brand, data, credentials, supply chain, and customer base.\nExternal Collaboration & Information Sharing - Engage with Aviation-ISAC, government CERTs, law enforcement, and industry peers to share intelligence and contribute to the collective defense of the aviation sector.\n Technical Intelligence Integration - Curate and feed IoCs (malware hashes, IPs, domains) into SIEM (Elastic), SOAR (XSOAR), and XDR platforms (including CrowdStrike Falcon, Palo alto Cortex, Microsoft Defender and others) to enhance automated detection.\nThreat Hunting\nProactive Threat Hunting - Develop and execute hypothesis-driven hunts based on adversary TTPs, threat intelligence, and the MITRE ATT&CK framework to discover hidden threats across SITA’s endpoints, networks, cloud workloads, and airport infrastructure.\n Telemetry & Log Analysis - Analyze security logs, network traffic, endpoint telemetry (EDR/XDR), and system events using SIEM (Elastic/ELK) and XDR to identify anomalies, lateral movement, privilege escalation, and persistence mechanisms.\n Adversary Emulation Support - Collaborate with red/purple team exercises (AttackIQ BAS) to validate detection coverage, identify gaps, and test defensive controls.\n Intelligence-Driven Hunting - Operationalize threat intelligence (IoCs, IoAs, threat actor profiles) to drive targeted hunts against specific adversary campaigns relevant to SITA and the aviation sector.\nDocumentation & Reporting - Document all hunt hypotheses, methodologies, findings, and recommended mitigations. Produce hunt reports and contribute to the internal AI knowledge base.\nCross-Functional\nIncident Response Support - Provide threat intelligence context and hunting capabilities to CSIRT during security incidents - including threat actor attribution, TTP analysis, forensic context, and containment recommendations.\n Continuous Improvement - Contribute to the maturity of the CTI and Threat Hunting programs by refining collection requirements (PIRs), hunt methodologies, detection content, and feedback loops with stakeholders.\nDetection Engineering - Assist the development and refining of detection rules, SIEM use cases, and hunting playbooks based on hunt findings to continuously improve SITA’s automated detection capabilities.\nQualifications\nABOUT YOUR SKILLS\nEducation & Professional Qualifications\nBachelor’s Degree in Cybersecurity, Computer Science, Information Security, Intelligence Studies, or equivalent in a related field.\nAt least one recognized certification such as: GCTI, GCIH, GCFA, CEH, CySA+, GIAC, OSCP, Security+, CREST, CTIA, or CCTHP.\nExperience\n2+ years of experience in cyber threat intelligence, threat hunting, SOC L2+, or incident response.\nHands-on experience with SIEM (Elastic) and EDR/XDR platforms (CrowdStrike Falcon / Cortex / Defender).\nExperience with Threat Intelligence Platforms (Recorded Future, MISP, OpenCTI).\nFamiliarity with SOAR/XSOAR platforms for automation of intelligence and hunting workflows.\nPractical experience with the MITRE ATT&CK framework, Diamond Model, or Cyber Kill Chain for both intelligence analysis and hunt hypothesis development.\nTechnical Skills\nProficiency in OSINT collection techniques and tools (Maltego, SpiderFoot, Shodan, etc.).\nProficiency in log analysis and forensic techniques across endpoint, network, and memory.\nSolid understanding of networking protocols, operating systems internals (Windows/Linux), and common attack vectors.\nFamiliarity with malware analysis concepts (static/dynamic) and intrusion detection systems.\nScripting skills in Python, PowerShell, or KQL/EQL for data processing, automation, and custom hunting queries.\nFamiliarity with intelligence sharing standards (STIX/TAXII).\nFunctional Skills\nSkill\nExpected Level\nThreat Intelligence Analysis\nL3 - Practitioner\nThreat Hunting Techniques\nL3 - Practitioner\nSIEM / EDR Querying & Analysis\nL3 - Practitioner\nOSINT Collection & Analysis\nL3 - Practitioner\nIncident Response Support\nL2-L3\nCommunication & Reporting\nL3 - Practitioner\nProblem Solving\nL3 - Practitioner\nSoft Skills\nStrong analytical and critical thinking abilities - able to assess credibility, relevance, and impact of threat data.\nExcellent written and verbal communication - ability to translate complex technical findings into actionable intelligence for both technical and executive audiences.\nIntellectual curiosity and passion for continuous learning in a rapidly evolving threat landscape.\nAbility to work independently and collaboratively across a globally distributed team and rotating shifts.\nNICE-TO-HAVE\nCairo role: Fluency in Arabic for regional OSINT collection and MEA-focused threat hunting and intelligence.\nSingapore role: Fluency in Chinese (Mandarin) for APAC-focused APT tracking and intelligence.\nExperience in the aviation sector.\nFamiliarity with Breach and Attack Simulation (BAS) tools such as AttackIQ.\nExperience producing operational and tactical threat intelligence for technical audiences.\nWHAT WE OFFER\n Flex Week - Work from home up to 2 days/week (subject to team’s needs)\nFlex Location - Take up to 30 days a year to work from any location in the world\nEmployee Wellbeing - EAP for you and your dependents 24/7, 365 days/year\nProfessional Development - LinkedIn Learning, SANS training, and industry certifications\nCompetitive Benefits - Competitive benefits aligned with your local market\nSITA is an Equal Opportunity Employer. We value a diverse workforce. In support of our Employment Equity Program, we encourage women, aboriginal people, members of visible minorities, and/or persons with disabilities to apply and self-identify in the application process.\nSalary / Compensation Note\nHidden (-999)","description_format":"text","description_chars":8006,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"Chinese","level":"Advanced (C1)","optional":false},{"language":"Arabic","level":"Advanced (C1)","optional":false}]},"benefits":["Continuous learning","Equity","Professional development"],"hiring_locations":[{"name":"Singapore","iso":"SG","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Managed Network Services","Travel Technology","Border Security","Web Development Services"],"lifecycle":[{"event":"open","at":"2026-10-28T10:53:04Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":49,"reasons":["conf:3","stale_co","velocity","win:early","comp:junior,brand"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/sita-threat-analyst","json_url":"https://alion.io/job/sita-threat-analyst.json","meta":{"generated_at":"2026-10-30T07:37:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10695,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":94825},"rest":"https://alion.io/mcp/rest/get_company?id=94825"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsita-threat-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsita-threat-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsita-threat-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sita-threat-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsita-threat-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3392518}},{"tool":"search_jobs","arguments":{"company":"sita.aero","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3392518},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}