Cyber Threat Intelligence Production Manager
Deloitte Technology Cyber Risk Posted: 14-Aug-2025
Arlington, Virginia, United States
Baltimore, Maryland, United States
Hermitage, Tennessee, United States
Mclean, Virginia, United States
Nashville, Tennessee, United States
Richmond, Virginia, United States
Rosslyn, Virginia, United States
Tampa, Florida, United States
Work you'll do
- Lead a team of geographically dispersed intel analysts to accomplish your team’s missions.
- Produce monthly and quarterly threat intelligence reports that accurately describe recent cyber threats and events, ensuring information is relevant and timely for the Deloitte threat landscape.
- Develop executive-level briefings and respond to RFIs from senior leadership, delivering clear and actionable intelligence.
- Oversee the creation of geography-specific threat landscape reports and manage the quality of products produced by Production & Dissemination analysts.
- Provide quality control for all intelligence products, determine their relevancy, and ensure consumers receive accurate and up-to-date information.
- Manage the threat monitoring and alerting process to ensure customers are warned of imminent threats.
- Provide customers with easy access to relevant cyber threat information.
- Develop and maintain robust forecasting processes that provide critical insights to guide strategic planning and drive informed decision-making across the organization.
- Facilitate coordination between analysts across teams within Analysis & Production to ensure intelligence products are prepared for both operational and executive audiences.
- Work closely with the Intel Operations Manager to ensure data availability meets consumer requirements.
- Support the Analysis and Production Senior Manager in developing intelligence requirements, collecting feedback to improve products, and overseeing production metrics to enhance quality and efficiency.
- Serve as the acting Analysis and Production Senior Manager during their absence, ensuring continuity of operations and leadership.
- Organize and deliver training and professional development opportunities to maintain staff expertise.
- Lead the onboarding and training of new threat intelligence customers.
- Develop regular engagement with Member Firm executives to build and maintain strong working relationships.
- Minimal travel may be required as part of this role (>10% time) for participation in team events, conferences, and training.
The team
Qualifications
- Experience managing and mentoring both senior and junior analysts, including coordinating weekly tasks and deliverables.
- Strong English written and verbal communication skills, with the ability to present complex information clearly to diverse audiences.
- Knowledge of Threat Intelligence tradecraft and fundamental concepts, and experience in developing intelligence assessments.
- Demonstrated ability to oversee and provide quality control for intelligence products, ensuring accuracy, relevance, and timeliness.
- Strong interpersonal skills and ability to work well with people of diverse cultures and backgrounds.
- Deep subject matter expertise in threat actor tactics, techniques, and procedures (TTPs), with the ability to translate technical intelligence for operational and executive audiences.
- Knowledge of models that describe cyber-attacks (e.g., Cyber Kill Chain, Diamon Model, MITRE ATT&CK).
- Proficient in manipulating and analyzing complex datasets using various tools and techniques to uncover new insights, identify trends, and support informed decision-making.
- Demonstrated expertise in analyzing CVE and vulnerability reporting, including determining device impact.
- Experience producing and presenting clearly written operational, tactical, and strategic intelligence and writing concise research reports
- Experience in leading projects, tasks, and analytical or investigative processes with minimal oversight or direction; developing Standard Operating Procedure documents for new or existing processes.
- Communicate with stakeholders with varying levels of technical proficiency.
- Experience working independently and collaborating effectively with team members located in different geographic regions.
- Desire and ability to work in a dynamic, fast-paced environment.
- Demonstrated ability to identify, handle, and safeguard confidential and sensitive information with discretion and in accordance with organizational policies and best practices.
- Bachelor’s degree in cybersecurity, technology, intelligence studies, or related field of study; advanced degree preferred.
- Relevant industry certifications such as GIAC GCTI, CISSP, or similar are strongly preferred.
- Hands-on experience utilizing the MITRE ATT&CK framework for threat analysis and detection.
- Familiarity with formal aspects of threat intelligence, including cognitive biases, Analysis of Competing Hypotheses (ACH), and related methodologies.
- Proven ability to research and contextualize cybersecurity and geopolitical landscapes to inform situational awareness and risk assessments.
- Deep understanding of host and network forensic artifacts and indicators of compromise (IOCs), with the ability to interpret their significance and uncover malicious activity.
- Proficient in using Threat Intelligence Platform (TIP) software such as ThreatConnect, Anomali, ThreatQuotient, MISP, or other commonly used platforms.
- Experience conducting link analysis to identify relationships and patterns within threat data.
- Strong understanding of networking concepts, including basic IP communication, TOR, proxies, VPNs, other communication obfuscation methods, and the technical and administrative organization of the Internet.
- Knowledge of social media platforms and online communities, including both formal and informal venues such as forums, IRC, Jabber, Reddit, and others.
- Skilled in open-source investigation techniques and experienced with open-source tools such as VirusTotal, Hybrid Analysis, Domain Tools, and similar resources for assessing indicators.
- Experience leveraging the private sector and other published threat intelligence reporting to support effective decision-making.
- Practical experience using Splunk for log analysis, threat detection, and security monitoring within enterprise environments.
- While this is a remote position, the ability to commute to the Washington D.C. offices is preferred.