Incident Response and Threat Intelligence Analyst

Incident Response and Threat Intelligence Analyst

Major League Baseball (MLB) is seeking a dedicated Incident Response and Threat Intelligence Analyst to join our team. This role is crucial for detecting, investigating, and responding to cybersecurity incidents, fraud, and digital threats that impact the organization and its affiliates. You will be instrumental in integrating incident response, threat intelligence, digital risk protection, and fraud analysis to proactively identify risks, disrupt malicious activities, and strengthen our defenses through actionable intelligence, thorough investigations, and well-documented processes.

Responsibilities

• Support security and fraud incident response activities in coordination with the virtual Security Operations Center (vSOC) and internal stakeholders, including identification, containment, remediation, and post-incident analysis.
• Enhance digital risk protection, threat intelligence, and social media monitoring programs, delivering timely and actionable intelligence to support operational response and threat modeling.
• Conduct highly confidential digital and fraud investigations and produce clear, defensible investigative reports.
• Monitor and analyze the cyber threat and fraud landscape using OSINT, deep/dark web sources, industry tools, internal telemetry, and the MITRE ATT&CK framework to identify relevant threats, vulnerabilities, indicators of compromise (IOCs), and adversary tactics, techniques, and procedures (TTPs).
• Analyze system logs, transaction data, and user behavior to identify anomalies, high-risk patterns, and indicators of fraud; assess impact and develop mitigation and prevention strategies.
• Develop, maintain, and document incident-response playbooks, threat-intelligence processes, fraud workflows, policies, and procedures to improve operational consistency and effectiveness.
• Assist in producing threat intelligence briefs, metrics, and reports that communicate risk, trends, and business impact to technical and non-technical stakeholders.
• Support security awareness initiatives, including training programs and internal phishing campaigns, to strengthen organizational security and fraud resilience.
• Collaborate across teams to fulfill intelligence requests, support adversary simulation efforts, and align threat intelligence with evolving business objectives.
• Identify opportunities for security automation and SOAR-driven orchestration to improve response time, intelligence quality, and operational scalability across incident response, intelligence, and fraud programs.
• Monitor and identify instances of illegal streaming and piracy utilizing threat intelligence monitoring platforms, and manage the submission and execution of takedown efforts to support anti-piracy and brand protection initiatives.

Qualifications & Skills

• Bachelor’s or Master’s degree (completed or in progress) in Cybersecurity, Information Security, Software Engineering, or a related field.
• Demonstrated experience supporting incident response and conducting in-depth cyber, fraud, or digital investigations using OSINT, social media platforms, industry tools, and internal data sources.
• Strong understanding of malicious adversaries, threat actors, and campaigns, including indicators of compromise (IOCs) and adversary tools, techniques, and procedures (TTPs).
• Ability to handle highly sensitive and confidential information with discretion and professionalism.
• Excellent organizational, time management, documentation, and communication skills, with the ability to clearly articulate complex technical concepts, attack methods, and investigative findings to both technical and non-technical audiences.
• Familiarity with threat intelligence methodologies, analytical frameworks (e.g., MITRE ATT&CK), and intelligence reporting best practices.
• Foreign language proficiency in Spanish, Russian, Farsi, and/or Mandarin is a plus.

Key skills/competency

• Incident Response
• Threat Intelligence
• Cybersecurity
• Fraud Analysis
• Digital Investigations
• OSINT
• MITRE ATT&CK
• IOCs
• TTPs
• SOAR