Senior Cyber Threat Intelligence Analyst, Live Nation
CTI
Salary not provided
SQL
AWS
GCP
Python
Bash
Linux
Azure
Windows
Senior and Expert level
London
Remote from UK
UK (9:00 AM – 18:00 PM GMT)
Entertainment events promoter and producer
Be an early applicant
Entertainment events promoter and producer
1001+ employees
B2CLifestyleMusicEntertainmentEvents
Be an early applicant
Salary not provided
SQL
AWS
GCP
Python
Bash
Linux
Azure
Windows
Senior and Expert level
London
Remote from UK
UK (9:00 AM – 18:00 PM GMT)
1001+ employees
B2CLifestyleMusicEntertainmentEvents
Company mission
To help live music fans more easily and quickly find concert tickets and information about their favourite artists and venues.
Role
Who you are
- 5+ years of hands-on cyber threat intelligence experience in a dedicated CTI, cyber intelligence, or threat intelligence function
- Demonstrated experience conducting threat actor analysis, adversary tracking, campaign analysis, IOC/TTP analysis, and intelligence production, including use of MITRE ATT&CK or similar frameworks to structure analysis and communicate adversary behavior
- Strong understanding of the intelligence lifecycle, including requirements, collection, analysis, dissemination, and stakeholder feedback
- Proven ability to produce clear, actionable intelligence reports, assessments, briefings, and RFIs for technical and non-technical stakeholders
- Experience supporting threat hunting, incident response, detection engineering, vulnerability management, or security operations through intelligence outputs
- Experience mentoring, guiding, or influencing other analysts as a senior individual contributor or functional lead
- Strong knowledge of system, network, and application security, including Windows and Linux internals
- Experience analyzing threats using telemetry from SIEM, EDR, and TIP platforms, and familiarity with CTI tools and sources such as OSINT, dark web sources, ISACs, Recorded Future, Mandiant, Flashpoint, Anomali, ThreatConnect, or VirusTotal
- Hands-on experience investigating adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet-scan data sources such as VirusTotal, DomainTools, Shodan, Censys, or urlscan.io
- Experience triaging malware, phishing kits, or attacker tooling using sandbox or detonation environments and extracting IOCs, C2 infrastructure, and behavioral indicators
- Proficiency in at least one query language (KQL, SPL, CQL, SQL), the ability to read and understand code, and working scripting ability (e.g., Python, Bash) for enrichment and automation
- Strong written and verbal communication skills, including the ability to clearly explain methodology, analysis performed, intelligence produced, and resulting action, and to translate complex threat activity into business-relevant risk
- Cyber threat intelligence experience within live entertainment, ticketing, e-commerce, payments, or another high-volume consumer transaction environment
- Experience building or maturing CTI processes such as Priority Intelligence Requirements, collection plans, reporting standards, RFI workflows, or intelligence dissemination models
- Experience with ransomware, cybercrime, fraud-related threat intelligence, third-party exposure, or credential exposure analysis
- Experience conducting dark web, underground forum, or cybercrime ecosystem research, including persona management and operational security tradecraft
- Experience with static or dynamic malware analysis and reverse engineering using tools such as Ghidra, IDA, or x64dbg, or with network flow analysis and host forensics
- Experience authoring detection content such as YARA, Sigma, or Suricata rules, or SIEM correlation searches
- Experience tracking offensive tooling and C2 frameworks (e.g., Cobalt Strike, Sliver, Mythic) across internet-scan and telemetry data
- Familiarity with STIX/TAXII, threat intelligence enrichment pipelines, or TIP administration and automation
- Familiarity with cloud services and securing cloud environments (AWS, Azure, GCP)
- Exposure to AI use cases within cyber threat intelligence, such as intelligence collection, analysis acceleration, or reporting efficiency
- Experience collaborating with external intelligence-sharing groups such as ISACs, InfraGard, CISA, law enforcement, or intelligence community partners
- Security certifications such as GCTI, GCFA, GREM, OSCP, or CISSP
- Strong experience with question-driven analysis and structured analytic techniques
- Ability to analyze and correlate TTPs to an enterprise environment
- Ability to analyze and step through code to obtain potential IOCs or detection opportunities
- Ability to identify anomalies and trends across vast, unstructured datasets
- Be curious
- Ability to investigate adversary infrastructure using passive DNS, WHOIS, TLS certificate, and internet-scan data, pivoting from a single indicator to broader campaign infrastructure
- Comfortable performing initial triage of malware samples, phishing kits, and attacker tooling in sandbox or detonation environments to extract IOCs, C2 configuration, and behavioral indicators
- Working knowledge of common C2 frameworks, commodity malware families, and phishing ecosystems, and how they present in network and endpoint telemetry
- Sound operational security practices for OSINT, dark web, and underground forum research, including persona and attribution management
- Ability to script enrichment and automation against threat intelligence and security tool APIs
- Proven experience tracking advanced threat actors and financially motivated cybercrime groups, including campaign, IOC, and TTP analysis
- Strong command of the intelligence lifecycle: requirements, collection, analysis, enrichment, dissemination, and feedback
- Understanding of the MITRE ATT&CK framework and how to use the MITRE Navigator to structure analysis and communicate adversary behavior
- Skilled writer. The ability to author and peer review tactical, operational, and strategic intelligence products for both technical and executive audiences
- Experience developing Priority Intelligence Requirements and collection priorities for a large organization
- Love to learn
- Comfortable briefing technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions
- Able to mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review
- Capable of operating within high-stakes, time-sensitive investigations
- Ability to translate complex threat activity into business-relevant risk and decision support
- Ability to read the room and adjust communications accordingly
- Ability to develop coalitions with other teams. We want to succeed through collaboration
What the job involves
- This is a hands-on senior individual contributor role for an analyst who wants to stay technical: researching threat actors and their infrastructure, digging into malware and phishing campaigns, tracking ransomware and the cybercrime ecosystems targeting live entertainment, ticketing, and e-commerce, and turning that research into intelligence that drives decisions
- The CTI Analyst will work cross-functionally with Detection Engineering, Incident Response, Threat Hunting, Vulnerability Management, Fraud, and external partners to provide actionable intelligence, and will help mature the CTI program while remaining closely engaged in day-to-day analysis
- Conduct hands-on cyber threat intelligence analysis focused on threat actors, campaigns, tactics, techniques, procedures, infrastructure, malware, phishing activity, ransomware, and the cybercrime ecosystems targeting live entertainment, ticketing, and e-commerce
- Produce tactical, operational, and strategic intelligence products including threat assessments, intelligence reports, executive briefings, RFIs, threat actor profiles, and actionable recommendations for stakeholders
- Own and support the intelligence lifecycle, including requirements gathering, collection, analysis, enrichment, dissemination, and feedback
- Translate raw threat data, OSINT, vendor intelligence, dark web research, internal telemetry, and partner reporting into clear, actionable intelligence
- Conduct technical research on malicious infrastructure, tooling, and tradecraft used by threat actors, including infrastructure pivoting, malware and phishing kit triage, and campaign attribution analysis
- Surface detection opportunities from technical research and partner with Detection Engineering to turn them into detection content such as YARA, Sigma, or SIEM queries
- Support threat hunting, detection engineering, incident response, vulnerability management, fraud, and broader cyber defense teams with intelligence-driven context and prioritization
- Develop and refine Priority Intelligence Requirements, collection priorities, analytical workflows, and reporting processes to improve the quality and relevance of CTI outputs
- Analyze threat actor behavior and map activity to frameworks such as MITRE ATT&CK to support defensive strategy and risk-based decision-making
- Brief technical, business, and senior leadership stakeholders on cyber threats, trends, potential business impact, and recommended actions
- Mentor and guide other analysts through influence, tradecraft coaching, intelligence writing, and analytical review
- Help mature CTI processes, tools, reporting standards, and intelligence outputs while remaining closely engaged in hands-on analysis
- Support the development and automation of threat analysis workflows and tooling, and operate threat intelligence platforms such as MISP, ThreatConnect, EclecticIQ, or Anomali
- Periodically participate in on-call rotations and support incident response efforts
Salary benchmarks
Our take
Live Nation is the world's leading live entertainment company, sitting at the top of the market in live events and ticketing. Formed in 2005, it is a major international company, with key business segments made up of concerts, ticketing, and sponsorship and advertising.
Despite its dominant position in the market, the company saw an 84% drop in revenue during 2020 and the closure of live events. Since then, however, demand has been stronger than ever for their ticket sales. This is a reflection that live events remain a clear priority for consumers and has been further reflected in Live Nation's acquisitions of companies, like Goodlive, that complement and bolster Live Nation's portfolio.
In addition to live events, a key area to watch for Live Nation will be the rise of online concert streaming, like that undertaken by competitors such as Driift. Major festivals such as Glastonbury have trialled online concerts with mixed reviews. If it proves successful, this could be a major new section of the entertainment market and a big potential part of Live Nation's future ventures.
Freddie
Company Specialist at Welcome to the Jungle
Insights
11% employee growth in 12 months
Company
Company benefits
- HEALTH: Medical, Dental and Vision benefits for you and your family, including Flexible Spending Accounts (FSA) and Health Savings Accounts (HSAs)
- YOURSELF: Paid time off policy including holidays, sick time, and day off for your birthday, free concert tickets
- WEALTH: 401(k) program with company match, Stock Program Reimbursement
- FAMILY: New parent programs & support including caregiver leave and baby bonus, infertility support
- CAREER: Tuition reimbursement, student loan repayment internal growth and development programs & trainings
- OTHERS: Volunteer time off, crowdfunding network
Company HQ
Beverly Hills, CA
Leadership
Michael Rapino
(CEO & President)Michael joined Live Nation Entertainment in 2005 as CEO and President. Previously, he spent 10 years in various Marketing and Entertainment roles at Labatt's Breweries of Canada. He also held several roles at Clear Channel Communications, including CEO and President of Global Music.
Share this job
View 58 more jobs at Live Nation