Principal Cyber Threat Intelligence (CTI) Analyst

Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!

Principal Cyber Threat Intelligence (CTI) Analyst

Location: Pune, India (Hybrid) / Remote

Department: Research

The Role

We're hiring a Principal CTI Analyst to serve as the intellectual engine behind Qualys's threat intelligence capability. You won't write reports that collect dust — you'll build the intelligence layer that turns exposure data into decisive action for thousands of organizations.

Your job is to deliver premium, tailored threat intelligence — insights that are relevant to the customer's environment, grounded in the latest threat landscape, and paired with actionable recommendations they can execute immediately.

What You'll Do

Curate Intelligence That Drives Action

• Serve as a key member of the team shaping the editorial direction of our threat intelligence stream — separating signal from noise at scale.
• Craft threat briefs that go beyond technical write-ups: context, relevance, and a clear call-to-action every time (isolate, patch, investigate, escalate).
• Set the bar for what "actionable intelligence" means inside the product.

Operationalize Threat Research

• Translate raw threat data into product-level requirements for Engineering — ensuring intelligence triggers remediation workflows, not just alerts.
• Leverage Qualys' massive backend telemetry to validate threat trends and shape product direction.

Accelerate Platform Value

• Define and demonstrate how embedded, contextualized intelligence elevates the platform's value for customers.
• Support key go-to-market motions: managed risk partnerships, federal programs, and freemium-to-paid conversion.

Who You Are

• 10+ years in Cyber Threat Intelligence, Incident Response, or Security Operations — with a track record of producing intelligence that changed outcomes, not just filled inboxes.
• You know the difference between commodity content anyone can Google and premium insight that customers can't find anywhere else — the kind that lights the road ahead and guides them toward better risk management.
• You instinctively connect threat actor behavior to defensive actions — patch, isolate, block, hunt.
• You understand the threat intel market — what organizations pay for, what they actually use, and where the gap is.
• You write at an elite level. You can make a complex threat understandable to a boardroom and specific enough for an engineer to act on — in the same brief.
• You think like a product builder, not just an analyst. Context, prioritization, and user experience matter to you as much as tradecraft.

Why This Role

• Impact — Your analysis will drive automated defense across millions of assets.
• Data — Access to one of the world's largest vulnerability and threat telemetry datasets.
• Vision — You're building the future of intelligence-driven remediation, not maintaining a legacy feed.