Job Summary:
Live Nation Entertainment – Cyber Security Operations, Cyber Security
THE TEAM
Live Nation is seeking a Senior Cyber Threat Intelligence (CTI) Analyst to drive hands-on intelligence analysis and research across our global environment. This role sits within the Detection and Response Engineering, CTI, and Threat Hunting team. The team focuses on identifying emerging threats, conducting in-depth analysis of malicious activity, and enhancing the organization’s security posture, detection, and incident response capabilities.
THE ROLE
This is a hands-on senior individual contributor role for an analyst who wants to stay technical: researching threat actors and their infrastructure, digging into malware and phishing campaigns, tracking ransomware and the cybercrime ecosystems targeting live entertainment, ticketing, and e-commerce, and turning that research into intelligence that drives decisions. The CTI Analyst will work cross-functionally with Detection Engineering, Incident Response, Threat Hunting, Vulnerability Management, Fraud, and external partners to provide actionable intelligence, and will help mature the CTI program while remaining closely engaged in day-to-day analysis.
WHAT THIS ROLE WILL DO
- Conduct hands-on cyber threat intelligence analysis focused on threat actors, campaigns, tactics, techniques, procedures, infrastructure, malware, phishing activity, ransomware, and the cybercrime ecosystems targeting live entertainment, ticketing, and e-commerce.
- Produce tactical, operational, and strategic intelligence products including threat assessments, intelligence reports, executive briefings, RFIs, threat actor profiles, and actionable recommendations for stakeholders.
- Own and support the intelligence lifecycle, including requirements gathering, collection, analysis, enrichment, dissemination, and feedback.
- Translate raw threat data, OSINT, vendor intelligence, dark web research, internal telemetry, and partner reporting into clear, actionable intelligence.
- Conduct technical research on malicious infrastructure, tooling, and tradecraft used by threat actors, including infrastructure pivoting, malware and phishing kit triage, and campaign attribution analysis.
- Surface detection opportunities from technical research and partner with Detection Engineering to turn them into detection content such as YARA, Sigma, or SIEM queries.
- Support threat hunting, detection engineering, incident response, vulnerability management, fraud, and broader cyber defense teams with intelligence-driven context and prioritization.
- Develop and refine Priority Intelligence Requirements, collection priorities, analytical workflows, and reporting processes to improve the quality and relevance of CTI outputs.
- Analyze threat actor behavior and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk-based decision-making.
- Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions.
- Mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review.
- Help mature CTI processes, tools, reporting standards, and intelligence outputs while remaining closely engaged in hands-on analysis.
- Support the development and automation of threat analysis workflows and tooling, and operate threat intelligence platforms such as MISP, ThreatConnect, EclecticIQ, or Anomali.
- Periodically participate in on-call rotations and support incident response efforts.
WHAT THIS PERSON WILL BRING
- 5+ years of hands-on cyber threat intelligence experience in a dedicated CTI, cyber intelligence, or threat intelligence function.
- Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behavior.
- Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination, and stakeholder feedback.
- Proven ability to produce clear, actionable intelligence reports, assessments, briefings, and RFIs for technical and non-technical stakeholders.
- Experience supporting threat hunting, incident response, detection engineering, vulnerability management, or security operations through intelligence outputs.
- Experience mentoring, guiding, or influencing other analysts as a senior individual contributor or functional lead.
- Strong knowledge of system, network, and application security, including Windows and Linux internals.
- Experience analyzing threats using telemetry from SIEM, EDR, and TIP platforms, and familiarity with CTI tools and sources such as OSINT, dark web sources, ISACs, Recorded Future, Mandiant, Flashpoint, Anomali, ThreatConnect, or VirusTotal.
- Hands-on experience investigating adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet-scan data sources such as VirusTotal, DomainTools, Shodan, Censys, or urlscan.io.
- Experience triaging malware, phishing kits, or attacker tooling using sandbox or detonation environments and extracting IOCs, C2 infrastructure, and behavioral indicators.
- Proficiency in at least one query language (KQL, SPL, CQL, SQL), the ability to read and understand code, and working scripting ability (e.g., Python, Bash) for enrichment and automation.
- Strong written and verbal communication skills, including the ability to clearly explain methodology, analysis performed, intelligence produced, and resulting action, and to translate complex threat activity into business-relevant risk.
- Cyber threat intelligence experience within live entertainment, ticketing, e-commerce, payments, or another high-volume consumer transaction environment.
- Experience building or maturing CTI processes such as Priority Intelligence Requirements, collection plans, reporting standards, RFI workflows, or intelligence dissemination models.
- Experience with ransomware, cybercrime, fraud-related threat intelligence, third-party exposure, or credential exposure analysis.
- Experience conducting dark web, underground forum, or cybercrime ecosystem research, including persona management and operational security tradecraft.
- Experience with static or dynamic malware analysis and reverse engineering using tools such as Ghidra, IDA, or x64dbg, or with network flow analysis and host forensics.
- Experience authoring detection content such as YARA, Sigma, or Suricata rules, or SIEM correlation searches.
- Experience tracking offensive tooling and C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic) across internet-scan and telemetry data.
- Familiarity with STIX/TAXII, threat intelligence enrichment pipelines, or TIP administration and automation.
- Familiarity with cloud services and securing cloud environments (AWS, Azure, GCP).
- Exposure to AI use cases within cyber threat intelligence, such as intelligence collection, analysis acceleration, or reporting efficiency.
- Experience collaborating with external intelligence-sharing groups such as ISACs, InfraGard, CISA, law enforcement, or intelligence community partners.
- Security certifications such as GCTI, GCFA, GREM, OSCP, or CISSP
WHAT THIS PERSON WILL BRING - TECHNICAL COMPETENCIES
Advanced Analytical Skills
- Strong experience with question-driven analysis and structured analytic techniques.
- Ability to analyze and correlate TTPs to an enterprise environment.
- Ability to analyze and step through code to obtain potential IOCs or detection opportunities.
- Ability to identify anomalies and trends across vast, unstructured datasets.
- Be curious
Technical Research & Tradecraft
- Ability to investigate adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet-scan data, pivoting from a single indicator to broader campaign infrastructure.
- Comfortable performing initial triage of malware samples, phishing kits, and attacker tooling in sandbox or detonation environments to extract IOCs, C2 configuration, and behavioral indicators.
- Working knowledge of common C2 frameworks, commodity malware families, and phishing ecosystems, and how they present in network and endpoint telemetry.
- Sound operational security practices for OSINT, dark web, and underground forum research, including persona and attribution management.
- Ability to script enrichment and automation against threat intelligence and security tool APIs
Threat Intelligence Expertise
- Proven experience tracking advanced threat actors and financially motivated cybercrime groups, including campaign, IOC, and TTP analysis.
- Strong command of the intelligence lifecycle: requirements, collection, analysis, enrichment, dissemination, and feedback.
- Understanding of the MITRE ATT&CK framework and how to use the MITRE Navigator to structure analysis and communicate adversary behavior.
- Skilled writer. The ability to author and peer review tactical, operational, and strategic intelligence products for both technical and executive audiences.
- Experience developing Priority Intelligence Requirements and collection priorities for a large organization.
- Love to learn
Collaboration & Communication
- Comfortable briefing technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions.
- Able to mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review.
- Capable of operating within high-stakes, time-sensitive investigations.
- Ability to translate complex threat activity into business-relevant risk and decision support.
- Ability to read the room and adjust communications accordingly.
- Ability to develop coalitions with other teams. We want to succeed through collaboration.
- A collaborative and inclusive environment focused on mentorship, diversity of thought, and continuous growth.
- Remote-friendly and flexible work culture.
- Exposure to a wide range of threat landscapes across live entertainment, e-commerce, and cloud infrastructure.
- A chance to directly shape the maturity and impact of Live Nation’s global threat intelligence function.
- 401(K) retirement program with employer match
Live Nation Entertainment will never request payment or equipment purchases as part of the hiring process. Recruiters will only contact candidates from official Live Nation or affiliated brand email domains.
