Senior Cyber Intelligence Analyst in Raleigh

If you are motivated and believe in the credit union philosophy of "People Helping People," join our team!

The Senior Cyber Intelligence Analyst is the technical lead for intelligence-driven detection and exposure management. You own the analytic tradecraft, the detection engineering standards, and the intelligence products that shape how the organization prioritizes vulnerabilities, builds detections, and briefs leadership. You set the bar for the team's Splunk work, mentor analysts, and represent threat intelligence to peer teams and executives.

This is a senior individual-contributor role with real ownership. You are expected to define how the work gets done, not just do it, and to make defensible analytic calls that leadership will act on.

What you will do

• Lead threat intelligence and analysis: Own the intelligence requirements process; define priority intelligence requirements with stakeholders, maintain the collection plan, and evaluate feed and vendor value. Lead analysis of threat actors, campaigns, malware families, and TTPs relevant to financial services, our technology stack, and our third-party ecosystem, mapped to MITRE ATT&CK. Produce and quality-review decision-ready intelligence products at the tactical, operational, and strategic levels, including briefings for the CISO and contributions to governance and Board-level reporting. Own the threat-informed assessment of newly disclosed vulnerabilities and drive that assessment into vulnerability prioritization and emergency remediation decisions. Lead intelligence support to incident response: attribution, campaign context, indicator enrichment, and post-incident lessons that become detections and requirements. Represent the organization in industry sharing communities and build relationships with vendor and government intelligence contacts.
• Lead detection engineering: Own the detection engineering program in Splunk Enterprise Security: standards, lifecycle, coverage measurement, and the tuning process. Design and build high-value detections, correlation searches, and risk-based alerting logic; review and mentor others' detection work. Maintain the MITRE ATT&CK coverage map, prioritize gaps against current threat intelligence and crown-jewel assets, and drive a roadmap to close them. Establish detection-as-code practices; lead purple-team and adversary emulation exercises to validate detections and measure real coverage rather than assumed coverage.
• Lead threat hunting and exposure management: Design and run the threat hunting program; lead cross-source analysis correlating vulnerability data with endpoint, source control, network and edge, and email telemetry to identify exposed, exploitable, and actively targeted assets. Serve as the threat intelligence lead for the continuous threat exposure management program, ensuring exposure prioritization reflects real adversary behavior and business impact.
• Mentor, influence, and report: Mentor and technically guide analysts on the team; review analytic products and detections for rigor and clarity. Own the team's Splunk dashboards and scheduled reporting for intelligence metrics, detection coverage, hunt outcomes, and threat-informed vulnerability metrics that roll up to leadership reporting. Influence remediation and control decisions across IT operations, application owners, and engineering by presenting evidence-based risk assessments. Brief executives and governance audiences clearly and credibly.

What you bring

• Required: 7+ years in cybersecurity with at least 4 years in threat intelligence, detection engineering, or threat hunting, including experience leading work streams or projects. Expert hands-on Splunk skills; a track record of building detection programs or coverage strategies. Deep working knowledge of MITRE ATT&CK, structured analytic techniques, and intelligence product standards. Strong understanding of attacker tradecraft across various domains.
• Preferred: Experience in financial services or another regulated environment. Experience with relevant platforms and tools. Python for enrichment, automation, and data analysis; experience operating a threat intelligence platform. Certifications such as GCTI, GCDA, GCFA, GREM, or CISSP.

SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.