Andersen Lab

cyber threat intelligence analyst

In short

This role involves collecting, analyzing, and correlating cyber threat intelligence from OSINT, ISACs, and vendor feeds to track threat actors and campaigns for international organizations. The company is a cybersecurity and managed IT services provider delivering vulnerability management across a large multi-tenant environment. It requires at least 5 years of cybersecurity experience with 3+ years in a dedicated CTI role, hands-on experience with a threat intelligence platform (MISP, OpenCTI, ThreatConnect, Anomali, or Recorded Future), and strong knowledge of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain. The position is onsite in Warsaw, full-time, at senior level.

About the Project
The customer provides digital infrastructure, cloud services, cybersecurity, data-driven solutions, and managed IT support. It helps organizations modernize complex technology environments, strengthen security, and improve the reliability and scalability of digital operations. The project delivers cybersecurity and digital services to international organizations and strengthens vulnerability management across a large, heterogeneous, multi-tenant environment.
Responsibilities
•Collect, analyze, and correlate threat intelligence from open, commercial, and community sources, including OSINT, ISACs, and vendor feeds
•Track threat actors, campaigns, and TTPs relevant to international organizations, including state-sponsored groups
•Produce strategic, operational, and tactical intelligence reports and briefings for technical and management audiences
•Map threats to MITRE ATT&CK and develop detection use cases with SOC and SIEM teams
•Manage IOCs and their lifecycle in the TIP, and enrich SOC alerts and incident investigations
•Support incident response with actor attribution and context
•Share intelligence with partner organizations under agreed TLP protocols
Requirements
•At least 5 years of cybersecurity experience, including at least 3 years in a dedicated CTI role
•Hands-on experience with a threat intelligence platform such as MISP, OpenCTI, ThreatConnect, Anomali, or Recorded Future
•Strong command of MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain
•Experience conducting OSINT research and analyzing malware and phishing campaigns at indicator and TTP level
•Experience turning intelligence into detections with a SOC or SIEM team
•Clean professional records and willingness to undergo background verification
•English at Upper-Intermediate level or above
Nice to Have
•GCTI, CTIA, or GCIH certifications
•Experience with STIX/TAXII, YARA, or Sigma
•Experience in a public sector, international organization, NGO, or financial sector environment
•Python scripting for automation and data enrichment
•French, Spanish, Arabic, Russian, or Chinese language skills
Conditions
•Stable and competitive salary and an extensive benefits package
•Access to educational platforms, seminars, and learning resources
•Mentoring and onboarding systems
•Transparent performance reviews and assessments, with opportunities to grow as a specialist or manager
•The company has been growing annually by 60–100% for the past four years
•The company has been strengthening its expertise since 2007 and has a knowledge base and resource management institution

Stop applying.
Get referred.

$10 in free credits

In just 60 seconds, fully on autopilot — Eraldt's AI agents read your CV, map the roles you fit, find live vacancies and the people who can refer you, write personal emails, and get you referred.

This isn't an application: your CV doesn't go to the company, and we don't promise a referral for this exact role.

Discover who else lands interviews on autopilot