{bc}
Apply
workday

Threat Intelligence Analyst, Associate - Security Operations

Blackstone
New York City, USA
Full-time
Junior · 2+ years experience
Onsite
Discovered 4 weeks ago
awsazuregeminiopenaipythonsplunk

Full Job Posting

Responsibilities

  • Monitor and analyze cyber threat activity targeting the financial sector, alternative asset management, and adjacent industries using open-source, commercial, and internal sources, correlating across them to identify patterns and provide early warning of emerging campaigns
  • Produce finished intelligence products and reports including recurring threat reporting, advisories, campaign profiles, actor dossiers, executive briefings, and visual products such as diagrams, tailored to both technical and non-technical audiences
  • Map adversary behaviors to the MITRE ATT&CK framework and maintain threat actor profiles covering TTPs, intent, and relevance to Blackstone
  • Extract, validate, enrich, and operationalize indicators of compromise (IOCs) to support detection engineering and incident response workflows
  • Leverage AI and automation tooling to scale collection, enrichment, and operationalization of intelligence
  • Partner with Alert, Detection & Response and Incident Response teams to translate intelligence into production detections (Splunk SPL, Sigma, YARA)
  • Track zero-day and critical vulnerabilities, assess Blackstone's exposure, and translate findings into new detections and preventions in coordination with detection and security engineering
  • Support threat-informed vulnerability prioritization (CVSS, EPSS, CISA KEV) and coordinate remediation tracking with asset owners
  • Operate and evolve the firm's external Attack Surface Management (ASM) program, discovering and inventorying internet-facing assets across Blackstone and its portfolio companies, triaging newly discovered exposures and misconfigurations, and coordinating remediation
  • Support Fusion Center digital-threat monitoring, including brand, executive, and reputational exposure across OSINT, social media, and dark web sources
  • Contribute to intelligence sharing with trusted industry partners, ISACs (such as FS-ISAC), government partners (such as JCDC), and peer financial institutions
  • Participate in incident response and the SOC on-call rotation (occasional, roughly every other month) to respond to escalated security incidents

Qualifications

  • 2+ years of experience in cyber threat intelligence, security operations, incident response, or a related cybersecurity discipline
  • Demonstrated understanding of the cyber threat landscape, including prominent threat actor groups,
  • campaigns, and TTPs
  • Working knowledge of intelligence frameworks such as MITRE ATT&CK, the Diamond Model, or the Intelligence Cycle
  • Experience with threat intelligence platforms (TIPs), SIEM tools (e.g., Splunk), OSINT research methodologies, or attack surface management / vulnerability management tooling
  • Scripting or programming experience (Python preferred) for automating data collection, enrichment, and analytic workflows
  • Demonstrated, hands-on experience applying AI tooling (such as LLMs and coding assistants) to real work, and can clearly speak to several projects where you used AI to automate or accelerate a task
  • Capable of writing clearly and developing visual products (such as diagrams) to communicate complex cyber threats to both technical and non-technical stakeholders, including executive leadership
  • Strong analytical reasoning, attention to detail, and capable of prioritizing effectively in a fast-paced environment
  • B.S. in Computer Science, Cybersecurity, Intelligence Studies, International Relations, or a related field
  • Experience in the financial sector or an organization with a global threat landscape
  • Hands-on experience with Attack Surface Management platforms (e.g., Mandiant ASM, CrowdStrike Falcon Surface, Microsoft Defender EASM, or similar)
  • Hands-on experience with specific AI developer tooling, such as LLM assistants and APIs (e.g., ChatGPT/OpenAI, Claude/Anthropic, Gemini), coding assistants (e.g., GitHub Copilot, Cursor), or agentic and automation frameworks
  • Experience with vulnerability management programs, including prioritization frameworks (CVSS, EPSS, CISA KEV) and remediation tracking
  • Familiarity with structured analytic techniques and intelligence writing standards
  • Experience with detection content development (Sigma, YARA, Splunk SPL, or KQL)
  • Active participation in industry working groups, ISACs, or CTI community forums
  • Relevant certifications (GIAC GCTI, Security+, CTIA, or similar)
  • Exposure to cloud environments (AWS, Azure) and an understanding of cloud-specific threat vectors
  • The duties and responsibilities described here are not exhaustive and additional assignments, duties, or responsibilities may be required of this position. Assignments, duties, and responsibilities may be changed at any time, with or without notice, by Blackstone in its sole discretion.
  • Actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, qualifications and job location. For roles located outside of the US, please disregard the posted salary bands as these roles will follow a separate compensation process based on local market comparables. Additional compensation and benefits offered in connection with the role consist of comprehensive health benefits, including but not limited to medical, dental, vision, and FSA benefits; paid time off; life insurance; 401(k) plan; and discretionary bonuses. Certain employees may also be eligible for equity and other incentive compensation at Blackstone’s sole discretion.
  • Blackstone is committed to providing equal employment opportunities to all employees and applicants for employment without regard to race, color, creed, religion, sex, pregnancy, national origin, ancestry, citizenship status, age, marital or partnership status, sexual orientation, gender identity or expression, disability, genetic predisposition, veteran or military status, status as a victim of domestic violence, a sex offense or stalking, or any other class or status in accordance with applicable federal, state and local laws. This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, transfer, leave of absence, compensation, and training. All Blackstone employees, including but not limited to recruiting personnel and hiring managers, are required to abide by this policy.
  • If you need a reasonable accommodation to complete your application, please contact Human Resources at 212-583-5000 (US), +44 (0)20 7451 4000 (EMEA) or +852 3656 8600 (APAC).
  • Attending client meetings where you are discussing Blackstone products and/or and client questions;
  • Marketing Blackstone funds to new or existing clients;
  • Supervising or training securities licensed employees;
  • Structuring or creating Blackstone funds/products; and
  • Advising on marketing plans prepared by a sales team or developing and/or contributing information for marketing materials.
  • Note: The above list is not the exhaustive list of activities requiring securities licenses and there may be roles that require review on a case-by-case basis. Please speak with your Blackstone Recruiting contact with any questions. To submit your application please complete the form below. Fields marked with a red asterisk * must be completed to be considered for employment (although some can be answered "prefer not to say"). Failure to provide this information may compromise the follow-up of your application. When you have finished click Submit at the bottom of this form.

Preferred Qualifications

  • Experience in the financial sector or an organization with a global threat landscape
  • Hands-on experience with Attack Surface Management platforms (e.g., Mandiant ASM, CrowdStrike Falcon Surface, Microsoft Defender EASM, or similar)
  • Hands-on experience with specific AI developer tooling, such as LLM assistants and APIs (e.g., ChatGPT/OpenAI, Claude/Anthropic, Gemini), coding assistants (e.g., GitHub Copilot, Cursor), or agentic and automation frameworks
  • Experience with vulnerability management programs, including prioritization frameworks (CVSS, EPSS, CISA KEV) and remediation tracking
  • Familiarity with structured analytic techniques and intelligence writing standards
  • Experience with detection content development (Sigma, YARA, Splunk SPL, or KQL)
  • Active participation in industry working groups, ISACs, or CTI community forums
  • Relevant certifications (GIAC GCTI, Security+, CTIA, or similar)
  • Exposure to cloud environments (AWS, Azure) and an understanding of cloud-specific threat vectors
  • The duties and responsibilities described here are not exhaustive and additional assignments, duties, or responsibilities may be required of this position. Assignments, duties, and responsibilities may be changed at any time, with or without notice, by Blackstone in its sole discretion.
  • Expected annual base salary range:
  • Actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, qualifications and job location. For roles located outside of the US, please disregard the posted salary bands as these roles will follow a separate compensation process based on local market comparables. Additional compensation and benefits offered in connection with the role consist of comprehensive health benefits, including but not limited to medical, dental, vision, and FSA benefits; paid time off; life insurance; 401(k) plan; and discretionary bonuses. Certain employees may also be eligible for equity and other incentive compensation at Blackstone’s sole discretion.
  • Blackstone is committed to providing equal employment opportunities to all employees and applicants for employment without regard to race, color, creed, religion, sex, pregnancy, national origin, ancestry, citizenship status, age, marital or partnership status, sexual orientation, gender identity or expression, disability, genetic predisposition, veteran or military status, status as a victim of domestic violence, a sex offense or stalking, or any other class or status in accordance with applicable federal, state and local laws. This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, transfer, leave of absence, compensation, and training. All Blackstone employees, including but not limited to recruiting personnel and hiring managers, are required to abide by this policy.
  • If you need a reasonable accommodation to complete your application, please contact Human Resources at 212-583-5000 (US), +44 (0)20 7451 4000 (EMEA) or +852 3656 8600 (APAC).
  • Depending on the position, you may be required to obtain certain securities licenses if you are in a client facing role and/or if you are engaged in the following:
  • Attending client meetings where you are discussing Blackstone products and/or and client questions;
  • Marketing Blackstone funds to new or existing clients;
  • Supervising or training securities licensed employees;
  • Structuring or creating Blackstone funds/products; and
  • Advising on marketing plans prepared by a sales team or developing and/or contributing information for marketing materials.
  • Note: The above list is not the exhaustive list of activities requiring securities licenses and there may be roles that require review on a case-by-case basis. Please speak with your Blackstone Recruiting contact with any questions. To submit your application please complete the form below. Fields marked with a red asterisk * must be completed to be considered for employment (although some can be answered "prefer not to say"). Failure to provide this information may compromise the follow-up of your application. When you have finished click Submit at the bottom of this form.

Apply for this job in 1 click

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Sarah M.James T.Maya R.

Trusted by over 500,000 job seekers on Base Career

Start Free Today

More from this employer

More jobs at Blackstone

Blackstone Credit & Insurance (BXCI) Investment Fund Modeling & Forecasting

London, GBR

Discovered TodayFull-time

2024 Blackstone Tactical Opportunities Analyst

London, GBR

Discovered YesterdayFull-time

Tactical Opportunities, Associate/ Senior Associate Investor

London, GBR

Discovered YesterdayFull-time

Tactical Opportunities, Associate Investor

London, GBR

Discovered YesterdayFull-time

ICS Executive Assistant, Abu Dhabi

Abu Dhabi, UAE

Discovered 2 days agoFull-time

ICS Executive Assistant, Abu Dhabi

, UAE

Discovered 2 days agoFull-time

BXTI - Vice President, Product Manager - Master Data Management (MDM)

Bengaluru, IND

Discovered 2 days agoFull-time

SVP – Program Manager – Finance & Operations Technology

Bengaluru, IND

Discovered 2 days agoFull-time