Lead Threat Analyst

WHAT YOU'LL DO

Leadership
Lead the Cairo CTI & Hunting Team - Mentor and develop Cairo-based Threat Intelligence Analysts and Threat Hunters, set team targets and objectives aligned with our SOC strategy, and foster professional growth.
Operational Coordination - Ensure seamless shift handoffs between Cairo, Singapore and Montreal to maintain continuous global coverage.
Stakeholder Communication - Serve as the primary Cairo subject matter expert liaison to CSIRT leadership, reporting significant findings, hunt outcomes, and intelligence products to senior management.
Quality Assurance - Review and approve intelligence products and hunt reports produced by the Cairo team before dissemination.

Threat Intelligence (Hands-On)
Intelligence Program Execution - Oversee the full intelligence lifecycle: collection requirements (PIRs), gathering, analysis, production, dissemination, and feedback.
Strategic & Operational Intelligence - Produce and oversee high-quality finished intelligence products including Threat Landscape Reports, Threat Actor Profiles, Flash Alerts, and executive briefings with a focus on MEA regional threats.
Source Management - Manage relationships with intelligence sources including Recorded Future, Mandiant, Aviation-ISAC, government CERTs, and regional law enforcement.
Dark Web Operations - Oversee dark web monitoring and credential exposure investigations, ensuring timely escalation and remediation coordination.

Threat Hunting (Hands-On)
Hunt Strategy & Methodology - Develop and maintain threat hunting hypotheses, tactics, techniques, and procedures. Lead the team in proactive, hypothesis-driven hunts aligned with MITRE ATT&CK during the MEA time zone.
Detection Engineering Oversight - Ensure hunt findings are translated into updated SOC use cases, detection rules, and SIEM content to continuously improve automated defenses.
Adversary Emulation Coordination - Coordinate purple team and attack simulations exercises, validate detection coverage, and drive remediation of identified gaps.
Incident Response Integration - Lead the Cairo team's support during major security incidents, providing both intelligence context and forensic hunting capabilities to MEA CSIRT Incident responders.

ABOUT YOUR SKILLS

Education & Professional Qualifications
Bachelor's Degree in Cybersecurity, Computer Science, Information Security, Intelligence Studies, or equivalent. Master's degree is a plus.
At least one recognized certification such as: GCTI, GCIH, GCFA, GREM, OSCP, CEH, CISM, or CISSP.

Experience
5+ years of experience in cyber threat intelligence, threat hunting, or incident response, with at least 2 years in a lead or supervision type of role.
Demonstrated experience mentoring a team of security analysts or hunters.
Hands-on expertise with SIEM (Elastic), EDR/XDR (CrowdStrike Falcon, Cortex XDR), and Threat Intelligence Platforms (Recorded Future, MISP, OpenCTI).
Hands-on expertise with SOAR/XSOAR for automation of intelligence and hunting workflows.

Technical Skills
Advanced proficiency in log analysis, forensics, and threat hunting across endpoint, network, cloud, and identity telemetry.
Strong scripting skills in Python, PowerShell, KQL/EQL for hunting queries, automation, and data processing.
Deep understanding of OSINT collection, dark web intelligence, and malware analysis (static/dynamic).
Knowledge of intelligence sharing frameworks (STIX/TAXII, TLP) and industry collaboration models.

Functional Skills
Skill Expected Level
Team Leadership L3 L4
Threat Intelligence Analysis L4
Master Threat Hunting Techniques L3 L4
Detection Engineering L3
Practitioner Incident Management L3
Practitioner Communication & Stakeholder Management L4
Master Problem Solving L4
Master

Soft Skills
Proven leadership - ability to inspire and mentor team peers
Exceptional written and verbal communication able to produce executive-level briefings and translate technical findings for non-technical audiences.
Strategic thinker with an operational mindset balancing long-term program development with day-to-day tactical execution.
Strong cross-cultural awareness and ability to collaborate across global time zones.

NICE-TO-HAVE
Fluency in Arabic strongly preferred for regional OSINT, MEA threat landscape, and local stakeholder engagement.
Experience in the aviation sector.
Familiarity with Breach and Attack Simulation (BAS) tools such as AttackIQ.
Prior experience standing up or scaling a regional security team.

WHAT WE OFFER
Flex Week Work from home up to 2 days/week (subject to team's needs)
Flex Location Take up to 30 days a year to work from any location in the world
Employee Wellbeing EAP for you and your dependents 24/7, 365 days/year
Professional Development LinkedIn Learning, SANS training, and industry certifications
Competitive Benefits Competitive benefits aligned with your local market

SITA is an Equal Opportunity Employer. We value a diverse workforce. In support of our Employment Equity Program, we encourage women, aboriginal people, members of visible minorities, and/or persons with disabilities to apply and self-identify in the application process.

Salary / Compensation Note Hidden (-999)

Desired Candidate Profile

• Bachelor's Degree in Cybersecurity, Computer Science, Information Security, Intelligence Studies, or equivalent. Master's degree is a plus.
• At least one recognized certification such as: GCTI, GCIH, GCFA, GREM, OSCP, CEH, CISM, or CISSP.
• 5+ years of experience in cyber threat intelligence, threat hunting, or incident response, with at least 2 years in a lead or supervision type of role.
• Demonstrated experience mentoring a team of security analysts or hunters.
• Hands-on expertise with SIEM (Elastic), EDR/XDR (CrowdStrike Falcon, Cortex XDR), and Threat Intelligence Platforms (Recorded Future, MISP, OpenCTI).
• Hands-on expertise with SOAR/XSOAR for automation of intelligence and hunting workflows.
• Advanced proficiency in log analysis, forensics, and threat hunting across endpoint, network, cloud, and identity telemetry.
• Strong scripting skills in Python, PowerShell, KQL/EQL for hunting queries, automation, and data processing.
• Deep understanding of OSINT collection, dark web intelligence, and malware analysis (static/dynamic).
• Knowledge of intelligence sharing frameworks (STIX/TAXII, TLP) and industry collaboration models.
• Proven leadership - ability to inspire and mentor team peers
• Exceptional written and verbal communication able to produce executive-level briefings and translate technical findings for non-technical audiences.
• Strategic thinker with an operational mindset balancing long-term program development with day-to-day tactical execution.
• Strong cross-cultural awareness and ability to collaborate across global time zones.
• Fluency in Arabic strongly preferred for regional OSINT, MEA threat landscape, and local stakeholder engagement.
• Experience in the aviation sector.
• Familiarity with Breach and Attack Simulation (BAS) tools such as AttackIQ.
• Prior experience standing up or scaling a regional security team.