Threat Analyst
No salary listed
Junior
Bachelor's
Singapore
In PersonWork from home up to 2 days/week subject to team needs; up to 30 days/year may be worked from any location worldwide.
CybersecuritySecurity Operations & Incident Response
About the job
Requirements
- A bachelor's degree in Cybersecurity, Computer Science, Information Security, Intelligence Studies, or equivalent in a related field.
- At least one recognized certification such as GCTI, GCIH, GCFA, CEH, CySA+, GIAC, OSCP, Security+, CREST, CTIA, or CCTHP.
- At least 2 years of experience in cyber threat intelligence, threat hunting, SOC L2+, or incident response.
- Hands-on experience with SIEM (Elastic) and EDR/XDR platforms such as CrowdStrike Falcon, Cortex, or Defender.
- Experience with Threat Intelligence Platforms such as Recorded Future, MISP, or OpenCTI.
- Familiarity with SOAR/XSOAR platforms for automating intelligence and hunting workflows.
- Practical experience with the MITRE ATT&CK framework, Diamond Model, or Cyber Kill Chain for intelligence analysis and hunt hypothesis development.
- Proficiency in OSINT collection techniques and tools such as Maltego, SpiderFoot, and Shodan.
- Proficiency in log analysis and forensic techniques across endpoint, network, and memory.
- Solid understanding of networking protocols, operating system internals (Windows/Linux), and common attack vectors.
- Familiarity with malware analysis concepts (static/dynamic) and intrusion detection systems.
- Scripting skills in Python, PowerShell, or KQL/EQL for data processing, automation, and custom hunting queries.
- Familiarity with intelligence sharing standards (STIX/TAXII).
- Ability to assess the credibility, relevance, and impact of threat data.
- Ability to translate complex technical findings into actionable intelligence for technical and executive audiences.
- Ability to work independently and collaboratively across a globally distributed team and rotating shifts.
Responsibilities
- Collect and analyze data from OSINT, commercial threat feeds, Aviation-ISAC, dark web forums, law enforcement, government, and internal telemetry to identify emerging threats, threat actors, and vulnerabilities relevant to SITA and the aviation sector.
- Research and maintain profiles on threat actor groups targeting aviation, critical infrastructure, and SITA's operations globally.
- Produce and distribute intelligence products, including weekly Threat Newsletters, quarterly Threat Landscape Reports, Threat Actor Profiles, Flash Alerts, and Vulnerability & Exploit Intelligence briefs.
- Monitor dark web marketplaces, data leak sites, paste sites, and underground forums for threats to SITA's brand, data, credentials, supply chain, and customer base.
- Engage with Aviation-ISAC, government CERTs, law enforcement, and industry peers to share intelligence and contribute to collective defense of the aviation sector.
- Curate and feed indicators of compromise, including malware hashes, IPs, and domains, into SIEM, SOAR, and XDR platforms to enhance automated detection.
- Develop and execute hypothesis-driven hunts based on adversary tactics, techniques, and procedures, threat intelligence, and the MITRE ATT&CK framework across endpoints, networks, cloud workloads, and airport infrastructure.
- Analyze security logs, network traffic, endpoint telemetry, and system events using SIEM and XDR to identify anomalies, lateral movement, privilege escalation, and persistence mechanisms.
- Collaborate with red/purple team exercises using AttackIQ BAS to validate detection coverage, identify gaps, and test defensive controls.
- Operationalize threat intelligence, including indicators of compromise, indicators of attack, and threat actor profiles, to drive targeted hunts against relevant adversary campaigns.
- Document hunt hypotheses, methodologies, findings, and recommended mitigations; produce hunt reports and contribute to the internal AI knowledge base.
- Provide threat intelligence context and hunting capabilities to CSIRT during security incidents, including threat actor attribution, tactics, techniques, and procedures analysis, forensic context, and containment recommendations.
- Refine collection requirements, hunt methodologies, detection content, and stakeholder feedback loops to mature the CTI and Threat Hunting programs.
- Assist in developing and refining detection rules, SIEM use cases, and hunting playbooks based on hunt findings to improve automated detection capabilities.
Desired Qualifications
- For the Cairo role, fluency in Arabic for regional OSINT collection and MEA-focused threat hunting and intelligence.
- For the Singapore role, fluency in Chinese (Mandarin) for APAC-focused APT tracking and intelligence.
- Experience in the aviation sector.
- Familiarity with Breach and Attack Simulation (BAS) tools such as AttackIQ.
- Experience producing operational and tactical threat intelligence for technical audiences.
About the company
SITA provides IT and communications solutions for the air transport industry, serving airlines and airports worldwide. Its products cover areas such as passenger check-in, flight operations messaging, baggage tracking, and airport-to-airline communications, all delivered through a global network of integrated software systems and services. The company connects airlines, airports, ground handlers, and other partners to enable smooth travel operations and better customer experiences. What sets SITA apart is its long history (nearly a century) and its deep, industry-wide reach; it focuses on interoperability and end-to-end integration across the entire air transport ecosystem, backed by partnerships and a shared infrastructure rather than standalone products. The company’s goal is to keep building connections that unite the fragmented aviation industry and to deliver better solutions that streamline operations and improve the travel experience for customers.
Company Size
5,001-10,000
Company Stage
Debt Financing
Total Funding
$400M
Headquarters
Geneva, Switzerland
Founded
1949
Get referred to SITA
See people who can refer or advise you
Simplify's Take
What believers are saying
- Qatar Airways and Hamad International launched SITA Fast Pass across 700 touchpoints in July 2026.
- SriLankan Airlines awarded SITA Switzerland a $4.01 million, five-year global network contract.
- SITA's Border Flow Lane launched September 9, 2026, promising eight-times-faster border clearance.
What critics are saying
- San Francisco activists attacked SITA biometrics on August 27, 2026, over DHS data sharing.
- NEC, IDEMIA, and airport incumbents can commoditize biometrics, squeezing SITA's margins by 2027.
- If governments reject biometric identity, SITA's growth engine in borders and airports stalls.
What makes SITA unique
- SITA sits inside 1,000+ airports, linking airlines, airports, governments, and border agencies.
- Its Digital Travel Ecosystem spans 70+ governments and 2.2 billion annual passenger journeys.
- NEC and SITA's October 2026 partnership hardens biometrics into a global airport standard.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Remote Work Options
- Flexible Work Hours
- Wellness Program
- Professional Development Budget
- Training Programs