Tactical Intelligence Analyst

-Job description

If you’re looking for a career where you can make a real impression, join Global Service Center (GSC) HSBC and discover how valued you’ll be. HSBC is one of the largest banking and financial services organisationsin the world, with operations in 64 countries and territories. We aim to be where the growth is, enabling businesses to thrive and economies to prosper, and, ultimately, helping people to fulfil their hopes and realisetheir ambitions.

We are currently seeking an experienced professional to join our team in the role of Cyber Intelligence Analyst**.**

In the role of a CITA Cyber Intelligence Analyst, you will be aligned to the CITA Tactical Cyber Intelligence team and responsible for:

- Hunting for malicious infrastructure (IPs, domains, hashes) following the technical analysis of threat actor tactics, techniques, and procedures.
- Continually identifying data sources and methods to enhance and enrich the collection of malicious infrastructure.
- Developing processes and engaging in adversary engagement to maintain a proactive posture against cyber threats.
- Documenting and presenting technical findings and analysis to internal stakeholders.
- Assisting in the continuous identification and documentation of threat actor tactics, techniques, and procedures.

As a member of the broader CITA team, you will be assisting with and/or responsible for:

- Monitoring the global cyber threat landscape through open-source channels, raw-commercial datasets, participation in industry/government information sharing organizations/platforms, and cultivated personal relationships.
- Supporting the maintenance of a global capability for collection that considers market and business requirements and fully leverages the HSBC global footprint around location, culture, language, and proximity to high value partners.
- Participating in information sharing efforts across the industry that helps to drive a positive image of the bank with our peers and regulators in the markets we serve.
- Participation in and support of external active engagements with industry partners, law enforcement and the wider security community, that projects HSBC expertise in protecting the bank and its customers against systemic threats.
- Supporting a “self-critical” culture whereby identification of weaknesses in the bank's control plane (people, process, and technology) are brought to light in an effective manner and addressed.
- Supporting engagement of Global Businesses and Functions everywhere HSBC does business that drives a global up-lift in cybersecurity awareness helping to “tell the story” of HSBC Cybersecurity efforts.
- Advise HSBC leadership on the latest trends in cyber intelligence and best practices, through close collaboration and engagement with industry, academia, and government.
- Production of Management Information related to the Cyber Intelligence and Threat Analysis mission that is appropriate to the target audience, supported by data, and experienced analysis enabling informed decisions.
- Training, developing, and mentoring less experienced analysts.

**Qualifications**

To be successful in this role you should meet some of the following requirements:

- Ability to speak, read, and write in English.
- Excellent investigative skills, insatiable curiosity, and unafraid to ask questions and challenge the status quo.
- Ability to admit you do not know or understand but are willing to learn.
- Instinctive and creative, with an ability to think like the adversary.
- Knowledge of hacker culture, TTPs, and aligning information to MITRE ATT&CK.
- An external peer network for sharing intelligence.
- Self-motivated and possessing of a high sense of urgency and personal integrity.
- Highest ethical standards and values.
- Knowledge of intelligence analysis principles either through formal education/training or equivalent professional experience.
- Experience in identifying and responding to advanced attacker methodologies both within a corporate environment as well as external attack infrastructures, ideally with offensive experience and / or deception environment development (tripwire systems, honeypots, honey-token/accounts, etc.) using open source, vendor purchased, and bespoke/in-house developed solutions.
- Excellent communication and interpersonal skills with the ability to produce clear and concise technical reports for targeted audiences across internal and external stakeholders.
- Ability to collaborate across industry, academia, and government to solve complex cyber security problems.
- Experience conducing public presentations on complex cyber threat topics for customers, executives, financial sector employees, and external audiences.

***
Requirements

**Technical Skills**
- Experience with various computer programming, scripting, and pattern matching languages (e.g., Python, JavaScript, Yara, etc.)
- Knowledge of reverse engineering malware utilizing both dynamic and static analysis tools