Skip to main content
CRYPTOMIZE

Command palette — search the ecosystem

Search services, platforms, products, client sectors, and company pages.

TRACK DOSSIER · INTERNSHIPREF: CM/INT/CYBER-INTELL

Cyber Intelligence Analyst Internship — Always Hiring

Cyber Intelligence Analyst Internship in Delhi at CryptoMize

Apply now for the Cyber Intelligence Analyst Internship in Delhi at CryptoMize — a 6-month certified program on a rolling, always-hiring intake. Cyber Intelligence analysts here work on real engagement threat data across the five intelligence domains: perception baselines, political campaign threats, brand impersonation, fraud detection, and disinformation. The role sits in the cybersecurity and intelligence cells, working alongside the security operations and OSINT teams on the S3-SENTINEL and CLAIRVOYANCE CX platforms, with the same operational model as every other CryptoMize cell: capacity is hired ahead of the next engagement, not after. From the opening fortnight you sit inside the real workflow — feeds normalized, indicators correlated, assessments written — and the work that ships under your name during the program is the work that decides the offer that follows it. This page is the complete internship description: the craft, the eligibility, the six-month path, and the selection process.

QUICK ANSWER

A Cyber Intelligence Analyst intern at CryptoMize turns raw threat input — harvested indicators, channel chatter, field captures — into actor-level intelligence for live client engagements, working the seam between the security-operations and OSINT cells where threat data becomes the material strategists brief from.

LOCATIONNew Delhi (HQ)
DURATION6 Months · Certification Provided
AVAILABILITYImmediate · Rolling intake
COMPENSATIONDiscussed at screening
TRACKS ON THIS DESK38
CRAFT SKILLS NAMED16
TOOLS & SYSTEMS5
PATH STAGES5

01The actual work

What will you actually do as a Cyber Intelligence Analyst at CryptoMize?

Consume the collection layer's output — curated feeds, harvested indicators, field reports — and turn raw input into actor-level threat intelligence for the cell's engagements

Correlate indicators across feeds to produce IOC databases and threat-actor profiles specific to client engagements

Write threat-assessment reports for political, healthcare, and enterprise clients that the strategist takes to briefings within 24–48 hours of collection

Own the severity model — separating credible threats from background noise across the client portfolio

Brief the security-operations team on emerging threat patterns that affect client engagement posture

Carry a personal investigator role on one client engagement, building a portfolio of assessed threats by month three

Track an actor from first indicator to named profile — infrastructure, personas, and timing patterns compiled into the dossier the strategist carries

Grade every escalation against the severity model before it moves upward, the discipline that keeps the cell’s signal credible when volume spikes

Rehearse the briefing loop: your written assessment delivered verbally to the security lead until the question rounds stop finding gaps

02Capability profile

What skills and tools does a Cyber Intelligence Analyst need?

Threat-actor profiling — TTPs, infrastructure, motivations, the analyst mindset that ties indicators to actor-level understandingOSINT-collection discipline — sourcing, verification, and the trail-building that lets a finding be re-verified months laterIndicator correlation — pivoting across feeds, spotting the same infrastructure or persona across unrelated sourcesReporting — short situational reports and longer-form threat assessments that the strategist takes to clients unchangedMISP fluency — IOC store, galaxy clusters, correlation engine, feed integrationTooling fluency — IOC extraction patterns, REST integrations into the MISP stack, and the query habits that make pivots fastDark-web exposure reading — working safely from collection-layer captures without burning analyst accessClaim triage — channel chatter graded against confirmed reporting before anything is escalated as threatInfluence-operations awareness — coordinated inauthentic behavior recognized as a threat vector alongside the technical onesNDA-grade indicator handling — chain of custody from first sighting to client brief, kept airtightCross-language threat material routed through the regional desks when an engagement’s actors operate outside EnglishClosed-loop briefing — the security team takes your report into the client briefing unchangedTimeline reconstruction — assembling an actor’s sequence of operations from timestamped indicatorsConfidence language — findings stated with the uncertainty they actually carry, never beyond itTicket hygiene inside the cell’s tracking system, because unlogged work is unrepeatable workCalm under escalation — threats that spike mid-afternoon still get a graded same-day read
MISP (Malware Information Sharing Platform) — the cell’s primary IOC store and correlation engineMISP galaxy cluster model for threat-actor and campaign-taxonomy classificationPython 3.11 + pandas for IOC aggregation and pivot queriesMISP-feed integration — STIX/TAXII import pipelines and the feed-credibility scoring modelOSINT framework — Maltego for link analysis, Shodan-class exposure scanning, the cell’s custom monitoring stack
Depth of demonstrated skill in the specific role disciplineClassification and scope of the client engagement the role supportsUrgency and time-sensitivity of active project requirementsTrack record built across CryptoMize engagements

Also known as: cyber intelligence analyst · threat intelligence analyst · cyber threat analyst · threat intel intern

03Six months, structured

Cyber Intelligence Analyst Internship — learning path at CryptoMize

Six months, threat-first. Every intern has a named senior analyst as mentor, and the program is built so a fresher exits with a portfolio of assessed threats rather than just a certificate — the assessed work is the credential the cell trusts.

  1. MONTH 1

    Feeds and tooling

    Open and normalize the cell’s primary feeds; learn MISP IOC structure, galaxy clusters, and the credibility-scoring model end-to-end. Daily short exercises grade real collections against the model so the scoring instinct forms before the volume arrives.

    1/5
  2. MONTH 2

    First assessed case

    Take one real client-relevant campaign through the full analyst cycle — collection, correlation, actor profile, written report — with mentor review at each step and a defense session where the profile’s conclusions are challenged until they hold.

    2/5
  3. MONTHS 3–4

    Engagement rotation

    Attached to a live client engagement under senior supervision — daily threat-brief work, weekly cross-cell reviews with the OSINT and security-operations benches, and incremental responsibility across the engagement portfolio as your graded reads prove reliable.

    3/5
  4. MONTH 5

    Independent investigator

    A self-driven investigation on an emerging threat pattern — scoping, collection liaison, correlation, and a written assessment with confidence language — which becomes part of the engagement portfolio and is defended before the cell leads.

    4/5
  5. MONTH 6

    Conversion

    Capstone presentation to the intelligence and security leads: the portfolio walked case by case, methodology questioned, and judgment examined under pressure. Strong interns convert to full-time Cyber Intelligence Analyst offers — the cell’s hiring model is ahead-of-demand, not after.

    5/5

04The engagement surface

CryptoMize work a Cyber Intelligence Analyst touches

Every role plugs into live engagements across the five Penta-P domains — these are the services your work feeds.

Cyber Intelligence Analyst · Internship

This seat plugs into 5 live CryptoMize services across the five Penta-P domains — the work below is where yours lands.

5 SERVICESPENTA-P

WHAT DOES CYBER INTELLIGENCE ANALYST COMPENSATION DEPEND ON?

Compensation is discussed during screening — never a fixed public figure, because it varies per person and per engagement. It depends on:

#OFFER CONSTRUCTION FACTOR
01Depth of demonstrated skill in the specific role discipline
02Classification and scope of the client engagement the role supports
03Urgency and time-sensitivity of active project requirements
04Track record built across CryptoMize engagements

05Answers, searchable

Cyber Intelligence Analyst Internship — frequently asked questions

AA Cyber Intelligence Analyst intern opens and maintains the threat-intel pipeline, correlates indicators across feeds to produce IOC databases and threat-actor profiles, and writes threat-assessment reports that the strategist takes to client briefings within 24–48 hours of collection.

The cell runs the same operational model as every other CryptoMize cell: capacity is hired ahead of the next engagement, not after.

AMISP as the cell’s primary IOC store and correlation engine, MISP galaxy clusters for threat-actor and campaign classification, Python and pandas for IOC aggregation and pivot queries, and the OSINT framework — Maltego for link analysis, Shodan-class exposure scanning, and the cell’s custom monitoring stack.

No prior fluency is assumed: the stack is taught in-house during Month 1, and every output you produce on it carries mentor review until the capstone.

AFinal-year students or recent graduates in cybersecurity, computer science, IT, or equivalent self-taught analysts with demonstrated ability.

No diploma is mandatory — the evaluation runs on demonstrated OSINT and indicator work, not paperwork. Basic scripting familiarity (Python or equivalent) is expected on arrival; the analytical depth, the tooling, and the briefing craft are what the six months teach.

ACompensation is discussed during the screening process and depends on demonstrated skill, engagement classification, urgency, and track record.

We deliberately do not publish figures — each intern is evaluated individually.

AA short application, a small OSINT task on a realistic engagement brief, and a final interview with the intelligence and security leads.

The whole cycle typically completes within two weeks because intake is rolling and the cell is staffed ahead of demand.

ACryptoMize serves political, enterprise, and healthcare-sector clients whose threat surface includes brand impersonation, campaign interference, fraud operations, and disinformation campaigns.

The cyber intelligence cell exists to support those engagements with the same analytical depth the OSINT and strategic-intelligence cells bring to their domains — the difference is the object: actors, infrastructure, and intent rather than public-record landscape.

AMornings run the feed triage queue and grade overnight collections against the severity model; midday is correlation work — pivoting indicators, extending actor profiles, closing the loops an overnight capture opened; afternoons alternate between writing, mentor markup, and the cell’s threat-brief review where the day’s escalations are defended out loud.

AThe OSINT cell owns collection — sweeps, verification, source-trail discipline across public and semi-public ground.

This desk owns what happens after: the threat-specific read where collected material becomes actor profiles, IOC sets, and graded assessments. The two cells share engagements, tooling, and review cadence, but the craft seats are distinct.

ACLAIRVOYANCE CX streams feed the collection side the desk consumes — social, news, and dark-web monitoring at a scale manual feeds never reach — while S3-SENTINEL telemetry supplies the security-operations context that tells an analyst whether an indicator is live in a client environment.

Interns learn to read both: the intelligence platform for what is being said and planned, the security platform for what is actually touching infrastructure.

ANo.

Certifications are noted but they are not the gate — the screening task and the interview decide, and a self-taught analyst who can walk through indicator work they have done will out-rank a certificate every time here. What matters on arrival is analytical honesty, basic scripting comfort, and the temperament to grade threats without inflating them.

AScripting level, not software engineering.

Pivot queries against the IOC store, small parsers that turn a repetitive manual check into a repeatable one, notebook work when an aggregation needs it — the cell’s engineers build the platform; the analyst builds the judgment on top of it. If you can read Python and write a short script unaided, the technical floor is met.

AThe capstone portfolio is examined by the intelligence and security leads, and strong interns receive full-time Cyber Intelligence Analyst offers — conversion is the cell’s primary hiring channel because six months of graded, reviewed threat work tells the desk more than any interview can.

Interns who finish mid-pack leave with the portfolio and certification; the door stays open for later application once external experience fills the gaps.

ROLLING INTAKE — ALWAYS HIRING

Apply now for the Cyber Intelligence Analyst Internship at CryptoMize

New Delhi HQ · Immediate joining · Certification provided for internships

Apply Now
Page source — machine-readable summary

Cyber Intelligence Analyst Internship — quick answer: A Cyber Intelligence Analyst intern at CryptoMize turns raw threat input — harvested indicators, channel chatter, field captures — into actor-level intelligence for live client engagements, working the seam between the security-operations and OSINT cells where threat data becomes the material strategists brief from.

Facts: Location: New Delhi (HQ) · Duration: 6 months, certification provided · Availability: immediate, rolling intake · Compensation: discussed at screening.

Q: What does a Cyber Intelligence Analyst intern do at CryptoMize?
A: A Cyber Intelligence Analyst intern opens and maintains the threat-intel pipeline, correlates indicators across feeds to produce IOC databases and threat-actor profiles, and writes threat-assessment reports that the strategist takes to client briefings within 24–48 hours of collection. The cell runs the same operational model as every other CryptoMize cell: capacity is hired ahead of the next engagement, not after.

Q: What tools will I use as an intern?
A: MISP as the cell’s primary IOC store and correlation engine, MISP galaxy clusters for threat-actor and campaign classification, Python and pandas for IOC aggregation and pivot queries, and the OSINT framework — Maltego for link analysis, Shodan-class exposure scanning, and the cell’s custom monitoring stack. No prior fluency is assumed: the stack is taught in-house during Month 1, and every output you produce on it carries mentor review until the capstone.

Q: What is the eligibility for the Cyber Intelligence Analyst Internship?
A: Final-year students or recent graduates in cybersecurity, computer science, IT, or equivalent self-taught analysts with demonstrated ability. No diploma is mandatory — the evaluation runs on demonstrated OSINT and indicator work, not paperwork. Basic scripting familiarity (Python or equivalent) is expected on arrival; the analytical depth, the tooling, and the briefing craft are what the six months teach.

Q: Is the internship paid?
A: Compensation is discussed during the screening process and depends on demonstrated skill, engagement classification, urgency, and track record. We deliberately do not publish figures — each intern is evaluated individually.

Q: What is the selection process?
A: A short application, a small OSINT task on a realistic engagement brief, and a final interview with the intelligence and security leads. The whole cycle typically completes within two weeks because intake is rolling and the cell is staffed ahead of demand.

Q: Why does a digital agency hire Cyber Intelligence Analysts?
A: CryptoMize serves political, enterprise, and healthcare-sector clients whose threat surface includes brand impersonation, campaign interference, fraud operations, and disinformation campaigns. The cyber intelligence cell exists to support those engagements with the same analytical depth the OSINT and strategic-intelligence cells bring to their domains — the difference is the object: actors, infrastructure, and intent rather than public-record landscape.

Signal keywordscyber intelligence analyst·internship·delhi·careers