Operational Cyber Threat Intelligence Analyst

We help the world run better

At SAP, we enable you to bring out your best. Our company culture is focused on collaboration and a shared passion to help the world run better. How? We focus every day on building the foundation for tomorrow and creating a workplace that embraces differences, values flexibility, and is aligned to our purpose-driven and future-focused work. We offer a highly collaborative, caring team environment with a strong focus on learning and development, recognition for your individual contributions, and a variety of benefit options for you to choose from.

Founded in 1972 in Germany, SAP stands as a global leader in enterprise software and cloud technology, serving businesses of all sizes across various industries. Renowned for its innovative solutions, SAP provides a comprehensive suite of software applications ranging from ERP (Enterprise Resource Planning) and CRM (Customer Relationship Management) to analytics and supply chain management. With a customer-centric approach, SAP empowers organizations to streamline operations, drive efficiency, and gain valuable insights to make informed business decisions. Through its robust cloud platform, SAP offers scalable and agile solutions that enable businesses to adapt to evolving market demands and digital transformations seamlessly. With a steadfast commitment to innovation and excellence, SAP continues to shape the future of technology and remains a trusted partner for businesses worldwide.

SAP is seeking an experienced Operational Cyber Threat Intelligence Analyst to work in SAP's Cyber Intelligence & Threat Hunting team as part of the larger Detect Organization. This is a position that requires deep knowledge of threat actor TTPs and the technical prowess to collect, process, and exploit raw data to identify and disrupt advanced cyber adversaries. Successful candidates will have demonstrable experience using advanced scripting and automation skills to collect a wide range of raw telemetry and signals to drive threat detection operations. Operating "left of boom," this position requires a proactive and innovative analyst capable of leveraging a diverse range of collection methods—including emerging artificial intelligence tools—to identify and exploit the most actionable data sets available. Additionally, this role will work with the Strategic Intelligence team to help translate tactical and operational threats into strategic risk reporting and over-the-horizon threat assessments.

In this role you will craft custom scripts to collect highly actionable information that enables cyber intelligence operations and informs the organization's understanding of the threat landscape at the adversary level. In addition, you will work with SIEM and SOAR technologies to further exploit and operationalize collected information to drive threat detection and threat hunting efforts. You will identify gaps in tooling utilization and optimize existing technologies to further mature and scale cyber intelligence capabilities. You will work with peer security teams and relevant stakeholders across lines of business to collect and disseminate threat intelligence as well as support critical incidents and investigations. You will identify, pivot, and enumerate adversarial infrastructure and build automated playbooks to drive proactive security actions across the organization. Lastly, this role requires a consummate team player willing to go above and beyond in delivering a world class operational cyber threat intelligence capability in support of SAP and its global business.

Key Responsibilities:

• Identify, track, and analyze cyber threat actors and their tactics, techniques, and procedures (TTPs) to help drive threat detection operations (TDO) by supporting detection engineering detection logic creation.
• Develop and maintain automated tools and scripts to enhance the collection and processing of cyber threat intelligence.
• Identify opportunities to drive tool optimization (i.e., threat intelligence platform) through advanced integrations with wider organizational technology stack.
• Track and enumerate prioritized adversary C2 infrastructure using open source tools to enable "left of boom" analysis and trigger automated playbook actions.
• Identify opportunities to integrate generative AI technologies into intelligence collection, processing, and analysis workflows.
• Use coding skills (e.g., Python, PowerShell) to create custom solutions for data extraction, correlation, and analysis.
• Utilize Security Information and Event Management (SIEM) tools to collect, correlate, and analyze security events and alerts and create custom dashboards to visualize data.
• Implement and manage Security Orchestration, Automation, and Response (SOAR) solutions to streamline and automate intelligence collection and follow-on actions
• Collaborate with incident response teams to contain and remediate critical incidents.
• Support Asymmetric Threat Hunting efforts by providing technical input on threat actor TTPs to enable hypotheses generation.

Required Skills and Qualifications:

• Bachelor's degree in Cybersecurity, Information Technology, Intelligence Studies or related fields.
• Proven experience (3+ years) as a Cyber Threat Intelligence Analyst with a focus on operational intelligence combining analysis with technical collection.
• Demonstrable experience in coding language, particularly Python and PowerShell.
• Strong proficiency in open source intelligence (OSINT) methodologies and tools for gathering, analyzing, and interpreting threat data.
• Proficiency in SIEM and SOAR platforms to enable cyber intelligence collection and processing of information through automated playbooks.
• Excellent report writing skills with the ability to create clear, concise, and impactful intelligence reports incorporating graphics and visualizations.
• Expert understanding of the intelligence lifecycle and associated analytic methodologies (Cyber Kill Chain, Diamond Model, ATT&CK, etc.)
• Experience in conducting threat intelligence briefings and presentations to senior management and decision-makers.
• Strong analytical skills with the ability to think critically and solve complex problems under pressure.

Preferred Qualifications:

• Certifications such as Certified Threat Intelligence Analyst (CTIA), Certified Information Systems Security Professional (CISSP), or equivalent.
• Experience with threat intelligence platforms, SIEM and SOAR platforms, and various security vendor portals/platforms.
• Expert knowledge of programming or scripting languages (e.g., Python, PowerShell) for automation and data analysis.

​

Bring out your best

SAP innovations help more than four hundred thousand customers worldwide work together more efficiently and use business insight more effectively. Originally known for leadership in enterprise resource planning (ERP) software, SAP has evolved to become a market leader in end-to-end business application software and related services for database, analytics, intelligent technologies, and experience management. As a cloud company with two hundred million users and more than one hundred thousand employees worldwide, we are purpose-driven and future-focused, with a highly collaborative team ethic and commitment to personal development. Whether connecting global industries, people, or platforms, we help ensure every challenge gets the solution it deserves. At SAP, you can bring out your best.

We win with inclusion

SAP's culture of inclusion, focus on health and well-being, and flexible working models help ensure that everyone – regardless of background – feels included and can run at their best. At SAP, we believe we are made stronger by the unique capabilities and qualities that each person brings to our company, and we invest in our employees to inspire confidence and help everyone realize their full potential. We ultimately believe in unleashing all talent and creating a better and more equitable world.

SAP is proud to be an equal opportunity workplace and is an affirmative action employer. We are committed to the values of Equal Employment Opportunity and provide accessibility accommodations to applicants with physical and/or mental disabilities. If you are interested in applying for employment with SAP and are in need of accommodation or special assistance to navigate our website or to complete your application, please send an e-mail with your request to Recruiting Operations Team:

For SAP employees: Only permanent roles are eligible for the SAP Employee Referral Program, according to the eligibility rules set in the SAP Referral Policy. Specific conditions may apply for roles in Vocational Training.

EOE AA M/F/Vet/Disability

Qualified applicants will receive consideration for employment without regard to their age, race, religion, national origin, ethnicity, age, gender (including pregnancy, childbirth, et al), sexual orientation, gender identity or expression, protected veteran status, or disability.

Compensation Range Transparency: SAP believes the value of pay transparency contributes towards an honest and supportive culture and is a significant step toward demonstrating SAP's commitment to pay equity. SAP provides the annualized compensation range inclusive of base salary and variable incentive target for the career level applicable to the posted role. The targeted combined range for this position is USD) USD. The actual amount to be offered to the successful candidate will be within that range, dependent upon the key aspects of each case which may include education, skills, experience, scope of the role, location, etc. as determined through the selection process. Any SAP variable incentive includes a targeted dollar amount and any actual payout amount is dependent on company and personal performance. Please reference this link for a summary of SAP benefits and eligibility requirements: SAP North America Benefits.

Requisition ID: | Work Area:Information Technology | Expected Travel: 0 - 10% | Career Status: Professional | Employment Type: Regular Full Time | Additional Locations: #LI-Hybrid

​