Threat Intelligence Analyst

I. PURPOSE
Support activities that improve operations and enable new service portfolios to achieve service excellence, operational efficiency, and customer retention.

II. DUTIES AND RESPONSIBILITIES

• Complete assigned tasks promptly and effectively in support of organizational objectives.
• Follow operational processes, escalation protocols, and service standards.
• Report significant events and ensure proper shift turnover.
• Maintain relevant operational knowledge and contribute to team collaboration.
• Promote professionalism, open communication, and positive client relationships.
• Comply with company policies, standards, and procedures.
• Perform other duties assigned by the Threat Intel Lead/Manager.

Threat Intelligence

• Monitor TIP data for emerging threats, vulnerabilities, campaigns, and relevant intelligence.
• Investigate threats, zero-day/pre-NVD vulnerabilities, threat actors, and industry trends affecting clients.
• Conduct advanced queries and contextual analysis using TIP tools.
• Prepare operational, tactical, incident-related, and ad hoc intelligence reports.
• Document and validate research findings and analyst notes.
• Detect and coordinate takedowns of phishing sites, fake applications, malicious websites, and fraudulent social media accounts.
• Identify brand attacks and data leaks and recommend appropriate mitigation.

Threat Hunting

• Conduct proactive threat hunting across client environments using known TTPs, malware indicators, and anomalous behaviors.
• Investigate emerging and complex threats and support incident response activities.
• Perform static and dynamic malware analysis to identify IOCs.
• Develop and maintain reusable threat-hunting techniques and playbooks.
• Collaborate with internal teams and client POCs to improve security architecture and incident response capabilities.

Service Management

• Monitor availability, capacity, risks, and managed assets and escalate issues beyond thresholds.
• Support Business Continuity Plan (BCP) execution and ensure SLA compliance.
• Follow configuration, service, and operational management processes.
• Provide feedback and recommendations for service improvement.

Client & Incident Support

• Triage and investigate security events and incidents and work toward timely service restoration.
• Follow client-specific playbooks for analysis, containment, eradication, remediation, and recovery.
• Maintain incident tickets, provide escalations, and prepare RCA and CA/PA reports.
• Process service requests within agreed SLAs.
• Manage brand monitoring and takedown activities.
• Support problem management, corrective/preventive actions, and contractual deliverables.
• Maintain accurate client and asset information and contribute to knowledge management and continual service improvement.

III. QUALIFICATIONS

A. Minimum Education

• Bachelor’s degree in Information Technology, Computer Science, Computer Engineering, Electronics Engineering, or other related IT field.

B. Minimum Experience/Training

• 1–2 years of experience in cybersecurity, security operations, threat intelligence, or related environment; or completion of the TRENDS Cadetship Program.
• Relevant training and/or certifications in:
• IT Service Management
• IT Infrastructure (Network, Servers, Cloud, etc.)
• Cybersecurity/Information Security
• Threat Intelligence (e.g., CTIA, GCTI, CCTIA)
• Threat Hunting (e.g., eCTHPv2 or equivalent)
• OSINT and Threat Intelligence

C. Competencies

• Strong analytical, investigative, and problem-solving skills
• Excellent written and verbal communication skills
• Attention to detail and ability to assess complex security information
• Ability to work effectively under pressure and in a shifting environment
• Strong collaboration and stakeholder management skills
• Willingness to continuously learn and develop cybersecurity expertise

IV. WORKING CONDITIONS

• Based at the company’s main office in Makati City.
• Willing to work on a shifting schedule.
• Collaborates with internal and external stakeholders through onsite and virtual engagements.
• May travel for client meetings, incident response activities, conferences, and related events.
• Expected to attend relevant training and obtain applicable certifications for the role.