Find your next role

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You’ll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. Analysts will work closely with X-Force Incident Response teams to triage cyber threat activity and provide critical intelligence support. You will leverage and integrate X-Force's proprietary telemetry, open-source intelligence (OSINT), and industry-leading sources within IBM to develop comprehensive threat models and intelligence research for publication.

The Threat Intelligence Consultant will work directly with the client to ensure the security solutions are implemented or improved according to the client’s business requirements. Analysts will also collaborate with various internal IBM teams (e.g., Incident Response, Product Development, Sales) and external partners to address diverse intelligence requirements, foster collaboration, and promote IBM’s thought leadership in the cybersecurity space. The ideal candidate will have demonstrated strong skills in proactive threat research and hunting, possess a deep understanding of cybersecurity threats and best practices, with a preference for experience gained within large enterprise environments, government agencies, or security vendors.

• Threat Landscape Awareness: Experience with developing and implementing cyber indicators to maintain awareness of evolving threat landscapes, ensuring organizations remain informed and prepared for potential cyber threats.
• Threat Data Analysis: Experience in collecting, processing, analyzing, and sharing cyber threat/warning assessments to inform stakeholders of potential cyber threats.
• Collection Strategy Execution: Experience with executing collections using well-defined strategies and within priorities set by collection management processes.
• Cyber Indicator Development: Experience in developing and implementing cyber indicators to support threat awareness and collection strategies.
• Threat Assessment Sharing: Experience with sharing cyber threat/warning assessments with stakeholders to ensure organizational preparedness for potential cyber threats.
• Performs proactive threat hunting based on emerging IOCs or vulnerabilities derived from analysis of network/host activity or open-source intelligence.
• Interprets incident response data such as malware analysis artifacts, digital forensic results, and log data.
• Develops comprehensive threat actor profiles, including their motivations, tactics, techniques, and procedures (TTPs), and innovates detection techniques for their activity, often aligning with frameworks like MITRE ATT&CK.
• Serves as a Subject Matter Expert (SME) on the threat landscape, including cyber-attack vectors, threat actors (e.g., nation-state, cybercriminal, hacktivist), malware families, and security trends impacting both public and private sectors.
• Takes a proactive approach to continuous learning about the latest threats, threat actors, TTPs, and malware families.
• Conducts and correlates threat research using OSINT, incident response engagement data, and proprietary tools.
• Performs threat modeling and produces intelligence threat assessments.

• 5+ years of experience conducting security research, producing threat assessments, and tracking threat actor groups and clustering threat activity.
• 3+ years of experience communicating security threats to both technical and non-technical audiences verbally and in writing via training, conferences, or client engagements.
• Experience identifying, analyzing, and documenting common malware infection chains and their associated Indicators of Compromise (IOCs).
• Experience setting up and using Virtual Machines for security research and analysis.
• Experience modeling threat actor activity in The Vertex Project designed by Synapse.
• Proficiency in utilizing and integrating data from a range of threat intelligence platforms and tools (e.g., VirusTotal, Microsoft Threat Defender, Domain Tools, Shodan, Censys, Maltego) and aligning findings to established threat models like MITRE ATT&CK.
• Experience with Security Information and Event Management (SIEM) systems and log analysis for threat detection and correlation.
• Experience working with incident response teams to provide timely and actionable threat intelligence.

Communication & Collaboration:

• Possesses strong verbal and written communication skills to deliver strategic, tactical, and operational intelligence to audiences with varying degrees of technical knowledge.
• Reviews technical literature prepared by other staff members for content, coverage, and clarity.

Soft Skills:

• Critical Thinking & Problem-Solving: Ability to analyze complex data, identify patterns, and draw insightful conclusions, especially under pressure.
• Attention to Detail: Meticulous approach to data analysis and reporting, ensuring accuracy and completeness.
• Collaboration & Teamwork: Strong ability to work effectively with diverse technical and non-technical teams.
• Adaptability & Continuous Learning: Eagerness to stay updated with evolving threats, technologies, and methodologies.

• Experience with automating repetitive tasks and familiarity with scripting languages (e.g., Python, PowerShell) for data manipulation, analysis, and tool development.
• Experience with creating YARA and/or Snort/Suricata rules.
• Experience analyzing threat activity in either nation-state or cybercriminal ecosystems.
• Familiarity with static and dynamic malware analysis tools (e.g., Ghidra, IDA Pro, Cuckoo Sandbox, Process Monitor, Wireshark) and techniques.
• Familiarity with cloud security concepts and common attack vectors in cloud environments.