Threat Intelligence Analyst L2
Capgemini
Job Description
Choosing Capgemini means choosing a company where you will be empowered to shape your career in the way you’d like, where you’ll be supported and inspired by a collaborative community of colleagues around the world, and where you’ll be able to reimagine what’s possible. Join us and help the world’s leading organizations unlock the value of technology and build a more sustainable, more inclusive world.
What will you do in the project? THREAT INTELLIGENCE ANALYST L2
A hybrid profile between Threat Hunting and Threat Intelligence Analyst with over 12 months of experience in cybersecurity operations, specializing in proactively looking for signs of attackers inside an organization’s environment—before alerts, incidents, or damage occur. Unlike traditional security roles that react to alarms, threat hunters assume compromise and actively search for hidden or stealthy threats.
A Threat Hunting Analyst must focus on searching for malicious behaviour that automated tools may miss, using human intuition, context, and hypotheses rather than waiting for alerts, in order to find advanced, persistent, and stealthy attackers
Adept at monitoring the evolving threat landscape and identifying potential risks to the organization by leveraging a variety of open-source intelligence (OSINT) tools, proprietary threat intelligence platforms (TIPs), and commercial feeds. This role must provide deep insights into identifying Indicators of Compromise (IoCs), analysing adversary tactics, techniques, and procedures (TTPs), and working in close collaboration with Security Operations Centres (SOC) and Incident Response teams to ensure timely detection and response to potential threats.
Key responsibilities
- Proactively conduct threat hunts to identify malicious activity that bypassed automated detections, reducing attacker dwell time
- Develop hypothesis-driven hunts based on adversary tactics, techniques, and procedures (TTPs) using the MITRE ATT&CK framework. Analyse endpoint, network, authentication, and log telemetry to detect indicators of compromise (IOCs) and anomalous behaviour
- Investigate suspicious activity involving credential misuse, lateral movement, persistence mechanisms, and living-off-the-land techniques. Correlate data across SIEM, EDR/XDR, and network security tools to validate potential threats and scope impact
- Leverage threat intelligence reports and internal telemetry to identify emerging attacker behaviours relevant to the environment
- Threat Intelligence Gathering & Analysis: Collect, evaluate, and analyse cyber threat data from various sources, including open-source, commercial, and internal threat feeds.