# Cyber Intelligence Analyst Job Opening at CryptoMize Cyber Intelligence Analyst jobs in Delhi at CryptoMize are open on a rolling, always-hiring basis. This is a full-time, permanent position with immediate joining, sitting inside the cybersecurity and intelligence cells that power the S3-SENTINEL and CLAIRVOYANCE CX platforms for political, healthcare, and enterprise clients across 18 countries. The senior analyst owns the threat-intel workstream for one or two engagements end-to-end — from pipeline maintenance to client-brief delivery — and the same operational model applies as every other cell: capacity is hired ahead of the next engagement, not after. Below is the complete job description, the responsibilities you will own from day one, the requirements, the seniority path, and the selection process. Experienced analysts who want their work to mean something — IOCs that flowed into a client briefing, threat profiles that shaped a political engagement — should read to the end. ## Facts - Location: New Delhi (HQ), CDR Building, Chhatarpur - Type: full-time permanent - Availability: immediate, rolling intake (always hiring) - Compensation: discussed at screening ## What you will actually do - Own the threat-intel workstream for one or two live client engagements — pipeline maintenance, IOC correlation, threat-actor profiling, and client-brief delivery - Set and maintain the cell’s credibility-scoring model — the discipline that separates real threats from noise across the client portfolio - Design the cell’s collection architecture for new engagements — feeds, OSINT coverage, dark-web monitors, and the bespoke tooling the engagement demands - Deliver the recurring threat products: daily situational reports, weekly cross-cell reviews, and quarter-scale threat-landscape narratives for client leadership - Mentor the analyst interns attached to your engagements — intern-to-analyst conversion is a hiring channel the cell directly strengthens - Sit in client briefings as the threat voice — when a client asks "is this real or noise," you answer with the IOC trail and the source stack - Work at the intelligence center of a portfolio that covers 18 countries, including political-campaign threats, healthcare-sector incidents, and brand-impersonation events — your analyst discipline becomes part of the engagement record the cell carries forward ## Skills - Senior threat-actor profiling — TTPs, infrastructure, motivations, the analyst mindset that ties indicators to actor-level understanding at scale - MISP operations — feed integration, galaxy-cluster maintenance, correlation-engine tuning, the discipline of running MISP as a production tool not a toy - OSINT collection discipline — sourcing, verification, trail-building, the rigor that lets a finding be re-verified months later by a different analyst - Reporting at the senior level — short situational reports the strategist takes to clients unchanged, longer-form threat assessments that become part of the engagement portfolio - Indicator correlation at scale — pivoting across feeds, spotting the same infrastructure or persona across unrelated sources, the judgment to know when correlation is signal vs noise - Tool fluency — Python and SQL for pivot queries, regex for IOC extraction, REST API for tool integration, the discipline of choosing the right tool for each question - Dark-web monitoring — Tor browser hygiene, hidden-service tracking, OPSEC-aware collection, the discipline of never breaking your own cover - Disinformation analysis — narrative tracing, amplification-path mapping, the analyst skill of identifying bot vs organic origin in a contested conversation - Discipline of NDA-grade client material — every indicator logged, every source traceable, every engagement flag-time recorded - Bilingual source handling where the engagement crosses languages (the cell works with regional translators when sources are not in English) - Client-facing communication — defending a finding under skeptical questioning, walking a client through the IOC trail in a briefing - Mentorship — the discipline of teaching analyst interns the way the senior analyst was taught, with the same review cadence and the same expectations ## Tools - MISP (Malware Information Sharing Platform) — the cell’s primary IOC store and correlation engine, with the full operational stack - MISP galaxy cluster model for threat-actor and campaign-taxonomy classification - Python 3.11 + pandas for IOC aggregation, pivot queries, and report automation - MISP-feed integration — STIX/TAXII import pipelines and the feed-credibility scoring model - OSINT framework — Maltego for link analysis, Shodan-class exposure scanning, the cell’s custom monitoring stack ## Questions and answers ### What are the requirements for Cyber Intelligence Analyst jobs at CryptoMize? Demonstrated MISP operations at production scale, senior-level threat-actor profiling, and the discipline of running the credibility-scoring model. Formal degrees are secondary to evidence — we hire on demonstrated capability, with formal credentialing for clinical-licensed roles being the only exception. ### Are the Cyber Intelligence Analyst jobs in Delhi? Yes — all cyber intelligence roles are based full-time at our New Delhi HQ in Vasant Vihar, working directly alongside the security operations and OSINT cells your analysis feeds. ### Is this a senior threat intelligence vacancy with immediate joining? Yes — openings are rolling and always active. The cell is staffed ahead of demand, not after. Strong candidates onboard as soon as notice periods allow. ### What is the career growth for a Cyber Intelligence Analyst at CryptoMize? The path runs Cyber Intelligence Analyst → Senior Cyber Intelligence Analyst → Cyber Intelligence Lead, with a crossover track into Intelligence Strategist for analysts who grow into client counsel. Advancement is by the quality of the threat picture produced, not tenure. ### What is the salary for Cyber Intelligence Analyst jobs at CryptoMize? Compensation is discussed at screening and depends on demonstrated skill, engagement classification, urgency, and track record. We do not publish figures — each offer is built individually, and worth is evaluated after meeting you, not before. ### How does the selection process work? Application, a paid-trial OSINT/threat-intel task on a realistic engagement brief, and a panel interview with the cell lead and the security operations lead where you walk through your findings and methodology under skeptical questioning. The cycle typically completes within two to three weeks. Apply: https://cryptomize.com/careers/job-openings/apply/