Senior Cyber Threat Analyst

At BBH we value diverse backgrounds, so if your experience looks a little different from what we've outlined and you think you can bring value to the role, we will still welcome your application!

What You Can Expect At BBH:

If you join BBH you will find a collaborative environment that enables you to step outside your role to add value wherever you can. You will have direct access to clients, information and experts across all business areas around the world. BBH will provide you with opportunities to grow your expertise, take on new challenges, and reinvent yourself—without leaving the firm. We encourage a culture of inclusion that values each employee’s unique perspective. We provide a high-quality benefits program emphasizing good health, financial security, and peace of mind. Ultimately we want you to have rewarding work with the flexibility to enjoy personal and family experiences at every career stage. Our BBH Cares program offers volunteer opportunities to give back to your community and help transform the lives of others.

As a Senior Cyber Threat Analyst within our Threat Detection Team, you will make a significant impact in enhancing our ability to anticipate, detect, analyze, and respond to cyber threats and proactively mitigating cyber risks effectively. With a focus on Cyber Threat Intelligence (CTI) and Threat Hunting, you will lead efforts to strengthen our security posture through proactive threat analysis, intelligence production, and alignment with industry frameworks and best practice guidance. Collaborating with cross-functional teams and interfacing with organizational leaders, you will contribute to innovative detection and response capabilities that protect our networks, systems, data, employees, and clients. The ideal candidate will have a strong background in cybersecurity with an analytical mindset, a passion for continuous learning and growth, and expertise in enhancing detection capabilities and delivering strategic threat insights.

Duties and Responsibilities:

• Perform strategic and operational CTI functions, including producing and disseminating weekly, monthly, and quarterly emails, products, reports, and briefings on the evolving threat landscape to internal stakeholders and senior leaders
• Monitor open-source, closed-source, and vendor-provided threat intelligence and current events to stay abreast of emerging cyber risks, threats, vulnerabilities, trends, and best practices, and make recommendations for proactive defense strategies and continuous process improvements
• Enhance threat detection and response capabilities by supporting the development of SOC and incident response (IR) procedures, escalation playbooks, and analyst decision trees
• Analyze and identify the likely threats targeting the organization through analysis of alert and IOC trends and use this information to build threat intelligence reporting as well as develop threat hunting strategies
• Develop and maintain threat profiles of relevant threat actors likely to or actively targeting the organization, including a catalog of their tactics, techniques, and procedures (TTPs) aligned with the MITRE ATT&CK framework
• Assist in SOC and IR escalations and investigations, providing expert guidance and context to ensure IR-related actions are threat-informed, effective, and timely
• Conduct threat, risk, and vulnerability assessments to provide actionable and prioritized remediation and control enhancement guidance to relevant control and system owners
• Work with Vulnerability Management to assist with developing and implementing threat-informed patch prioritization efforts, including through direct engagement with systems owners
• Collaborate with the Red Team and Cyber Incident Management to develop relevant red team assessments, penetration tests, incident response trainings, and tabletop exercises
• Using a threat-informed approach, plan and perform threat hunting activities by proactively searching across various logs within the Security Incident and Event Management (SIEM) solution and other security tools to identify previously undetected and unknown anomalous and malicious activity and indicators
• Conduct proactive analysis of alert trends to support intelligence reporting and to identify and prioritize missing or ineffective detection capabilities
• Perform privileged and general user access reviews across various platforms (Windows, Unix/Linux, RHEL, databases, network components, applications, cloud infrastructure) to identify anomalies and escalate appropriately
• Collaborate with DLP and other security teams on insider risk initiatives, collaborating and coordinating efforts to identify and mitigate potential threats from within
• Develop and uphold procedures, standards, and policies for CTI and threat hunting processes