Lead Threat Analyst (Cyber Threat Intelligence | Threat Hunting | GCTI)

OverviewWELCOME TO SITAWe’re the proactive cyber threat team responsible for keeping our airports, airlines, flying smoothly, and borders secure. Our tech and communication innovations are the secret behind the success of the world’s air travel industry. You’ll find us at 95% of international hubs. We partner closely with over 2,500 transportation and government clients, each with their own unique needs and challenges. Our goal is to find fresh solutions and cutting-edge tech to make their operations run like clockwork.Want to be a part of something big? Are you ready to love your job? The adventure begins right here, with you, at SITA.About The Role & TeamPosition TitleLead Threat Analyst - CairoProfession / Career StreamCyber Security – Cyber Threat Intelligence & Threat HuntingGrade5Reports ToSenior Manager Threat, CSIRT (EISO)LocationCairo, Egypt (MEA)Openings1As the Lead Threat Analyst (Grade 5) in Cairo, you will serve as the regional team lead part of the CSIRT Threat Team within SITA’s global Enterprise Information Security Office (EISO). Our mission is simple: proactively identify threats before they become incidents - essentially, determining who is “knocking at our door”. This dual-discipline role spans both Cyber Threat Intelligence (CTI) and Threat Hunting, enabling SITA to anticipate, detect, and act on adversary activity targeting SITA, its business units, subsidiaries, its customers and the broader aviation industry. You will be acting as a lead and mentor for the Cairo MEA Region based analysts and hunters.You will oversee both the intelligence production pipeline and proactive threat hunting operations for the Cairo hub, ensuring alignment with SITA’s global CSIRT mission and 24/7x365 coverage model.What You’ll DoLeadershipLead the Cairo CTI & Hunting Team - Mentor and develop Cairo-based Threat Intelligence Analysts and Threat Hunters, set team targets and objectives aligned with our SOC strategy, and foster professional growth.Operational Coordination - Ensure seamless shift handoffs between Cairo, Singapore and Montreal to maintain continuous global coverage.Stakeholder Communication - Serve as the primary Cairo subject matter expert liaison to CSIRT leadership, reporting significant findings, hunt outcomes, and intelligence products to senior management.Quality Assurance - Review and approve intelligence products and hunt reports produced by the Cairo team before dissemination.Threat Intelligence (Hands-On)Intelligence Program Execution - Oversee the full intelligence lifecycle: collection requirements (PIRs), gathering, analysis, production, dissemination, and feedback.Strategic & Operational Intelligence - Produce and oversee high-quality finished intelligence products including Threat Landscape Reports, Threat Actor Profiles, Flash Alerts, and executive briefings with a focus on MEA regional threats.Source Management - Manage relationships with intelligence sources including Recorded Future, Mandiant, Aviation-ISAC, government CERTs, and regional law enforcement.Dark Web Operations - Oversee dark web monitoring and credential exposure investigations, ensuring timely escalation and remediation coordination.Threat Hunting (Hands-On)Hunt Strategy & Methodology - Develop and maintain threat hunting hypotheses, tactics, techniques, and procedures. Lead the team in proactive, hypothesis-driven hunts aligned with MITRE ATT&CK during the MEA time zone.Detection Engineering Oversight - Ensure hunt findings are translated into updated SOC use cases, detection rules, and SIEM content to continuously improve automated defenses.Adversary Emulation Coordination - Coordinate purple team and attack simulations exercises, validate detection coverage, and drive remediation of identified gaps.Incident Response Integration - Lead the Cairo team’s support during major security incidents, providing both intelligence context and forensic hunting capabilities to MEA CSIRT Incident responders.QualificationsABOUT YOUR SKILLSEducation & Professional QualificationsBachelor’s Degree in Cybersecurity, Computer Science, Information Security, Intelligence Studies, or equivalent. Master’s degree is a plus.At least one recognized certification such as: GCTI, GCIH, GCFA, GREM, OSCP, CEH, CISM, or CISSP.Experience5+ years of experience in cyber threat intelligence, threat hunting, or incident response, with at least 2 years in a lead or supervision type of role.Demonstrated experience mentoring a team of security analysts or hunters.Hands-on expertise with SIEM (Elastic), EDR/XDR (CrowdStrike Falcon, Cortex XDR), and Threat Intelligence Platforms (Recorded Future, MISP, OpenCTI).Hands-on expertise with SOAR/XSOAR for automation of intelligence and hunting workflows.Technical SkillsAdvanced proficiency in log analysis, forensics, and threat hunting across endpoint, network, cloud, and identity telemetry.Strong scripting skills in Python, PowerShell, KQL/EQL for hunting queries, automation, and data processing.Deep understanding of OSINT collection, dark web intelligence, and malware analysis (static/dynamic).Knowledge of intelligence sharing frameworks (STIX/TAXII, TLP) and industry collaboration models.Functional SkillsSkillExpected LevelTeam LeadershipL3–L4Threat Intelligence AnalysisL4 – MasterThreat Hunting TechniquesL3–L4Detection EngineeringL3 – PractitionerIncident ManagementL3 – PractitionerCommunication & Stakeholder ManagementL4 – MasterProblem SolvingL4 – MasterSoft SkillsProven leadership - ability to inspire and mentor team peersExceptional written and verbal communication — able to produce executive-level briefings and translate technical findings for non-technical audiences.Strategic thinker with an operational mindset — balancing long-term program development with day-to-day tactical execution.Strong cross-cultural awareness and ability to collaborate across global time zones.NICE-TO-HAVEFluency in Arabic — strongly preferred for regional OSINT, MEA threat landscape, and local stakeholder engagement.Experience in the aviation sector.Familiarity with Breach and Attack Simulation (BAS) tools such as AttackIQ.Prior experience standing up or scaling a regional security team.What We OfferFlex Week — Work from home up to 2 days/week (subject to team’s needs)Flex Location — Take up to 30 days a year to work from any location in the worldEmployee Wellbeing — EAP for you and your dependents 24/7, 365 days/yearProfessional Development — LinkedIn Learning, SANS training, and industry certificationsCompetitive Benefits — Competitive benefits aligned with your local marketSITA is an Equal Opportunity Employer. We value a diverse workforce. In support of our Employment Equity Program, we encourage women, aboriginal people, members of visible minorities, and/or persons with disabilities to apply and self-identify in the application process.Salary / Compensation NoteHidden (-999)