Cyber Threat Intelligence Specialist (Cyber and Hybrid Threats)

About the role

The Information Systems Agency of Armenia (ISAA) is hiring a Cyber Threat Intelligence Specialist who manages the cyber threat intelligence (CTI) lifecycle: defining requirements, collecting and assessing information, producing timely intelligence products and turning them into operational detections, responses and risk decisions. The role sits at the intersection of security operations, incident response, engineering and policy, working closely with SOC analysts and incident responders. Because ISAA and AM-CERT are growing, the specialist also helps shape CTI processes, templates and tooling, and contributes to initiatives on election security, critical infrastructure protection and hybrid threat monitoring.

Key responsibilities

• Develop and manage the CTI lifecycle, from requirements and collection planning through analysis, production and dissemination to internal and external stakeholders.
• Collect and curate intelligence from open sources, CERT/CSIRT partners, commercial feeds and internal telemetry, coordinating with SOC and engineering teams.
• Identify, track and assess threat actors and their TTPs, mapping activity to frameworks such as MITRE ATT&CK.
• Produce actionable products (alerts, advisories, threat briefs, actor profiles, strategic assessments) for SOC/IR, technical owners, leadership and national stakeholders.
• Operationalize intelligence by supporting detection engineering and threat hunting with IOCs, behavioral patterns and hypotheses.
• Maintain CTI platforms and workflows (e.g. MISP, OpenCTI, TIP integrations) with cybersecurity engineers, ensuring data quality, tagging and sharing controls (e.g. TLP).
• Support incident response with rapid context and enrichment, and monitor cyber-enabled and hybrid threats, including campaigns combining cyber activity with information manipulation.
• Coordinate information sharing with national and international partners and contribute to exercises, tabletop simulations and playbook updates.

Required profile

• 3+ years of experience in cyber threat intelligence, SOC operations, incident response, threat hunting or a closely related cybersecurity role with a strong analytical focus.
• Bachelor's degree in Computer Science, Information Security, International Relations or a related field, or equivalent practical experience.
• Professional working proficiency in Armenian and English.
• Preferred: CERT/CSIRT experience, hands-on use of CTI platforms, scripting or data analysis skills, and experience with election security, critical infrastructure protection or public sector cybersecurity.

Required skills

• Solid understanding of attacker tradecraft, malware and phishing, and evidence in logs and telemetry.
• Familiarity with STIX/TAXII or similar sharing models.
• Working knowledge of SIEM, EDR, network monitoring and ticketing systems.
• Ability to write clear intelligence reports and brief technical and non-technical stakeholders.

To apply, send your CV by email to the agency, mentioning the position name in the subject line.