Threat Intelligence Lead (Remote)
Not Disclosed•Full-TimeRemote
location_on2925, H Street, Marshall School, East Sacramento, Sacramento, Sacramento County, California, 95816, United States
About RTX and Pratt & Whitney
At RTX, the world's largest aerospace and defense company, 185,000 great minds are united by purpose to solve the world's most complex problems. With three market-leading businesses and world-class operations, we push the boundaries of known science to connect and protect our world. Pratt & Whitney, a global leader in aircraft engine design and manufacturing for over 100 years, is at the forefront of revolutionizing modern flight.
About the Role
The Global Security Services (GSS) Threat Intelligence Lead serves as a pivotal cyber investigative and analytics role within the Threat Management and Intelligence program. Operating at the intersection of cybersecurity, digital forensics, and intelligence analysis, this position is dedicated to identifying, investigating, and mitigating risks related to the unauthorized movement of sensitive data, including intellectual property and controlled technical information.
In this capacity, you will lead complex investigations into data exfiltration and insider threat activity. The role demands a unique blend of investigative experience and technical expertise, leveraging enterprise security tools to detect anomalous behavior while utilizing open-source intelligence (OSINT) to enrich findings. Beyond reactive investigations, you will apply behavioral analytics and trend analysis to proactively identify insider threat indicators, delivering clear, actionable intelligence to stakeholders.
Mission Impact
This role offers direct mission impact by protecting sensitive aerospace technologies and national security programs. You will work with advanced investigative tools and datasets within an enterprise-scale environment, engaging with cross-functional teams including Cybersecurity, HR, Legal, and Compliance to coordinate response strategies and enhance the insider threat program.
Hiring Process and Application
As part of our commitment to maintaining a secure hiring process, candidates may be asked to attend select steps of the interview process in-person at one of our office locations, regardless of whether the role is designated as on-site, hybrid, or remote. RTX anticipates the application window closing approximately 40 days from the date the notice was posted, though business necessity may adjust this timeline.
Equal Opportunity Employer
RTX is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, or veteran status. RTX provides affirmative action in employment for qualified individuals with a disability and protected veterans in compliance with federal regulations.
Work location
Work model: Remote
2925, H Street, Marshall School, East Sacramento, Sacramento, Sacramento County, California, 95816, United States
Sacramento, California
Key Responsibilities
- check_circleLead complex investigations involving data exfiltration and insider threat activity
- check_circleValidate and triage alerts from DLP, SIEM, and UEBA platforms to reconstruct user activity
- check_circleCollect, preserve, and analyze digital evidence ensuring chain-of-custody and legal defensibility
- check_circleConduct forensic analysis of file transfers, user activity, and system artifacts
- check_circlePartner with Legal and HR to ensure investigations meet regulatory and evidentiary standards
- check_circleLeverage OSINT tools to identify external risk indicators and potential insider collusion
- check_circleConduct proactive threat hunting to identify previously undetected insider risk activity
- check_circleProduce clear investigative reports and intelligence briefings for technical and non-technical audiences
- check_circle
Requirements
- verifiedBachelor's degree in Cybersecurity, Computer Science, Criminal Justice, Intelligence Studies, or related field (or equivalent experience)
- verifiedMinimum 8 years experience in cyber investigations, digital forensics, insider threat, intelligence analysis, or related fields (or 5 years with Advanced Degree)
- verifiedU.S. Citizenship
- verifiedActive Top Secret security clearance
Nice to Have
Experience with data loss prevention tools and forensic platforms. Knowledge of classified environment operations, including associated security measures and protection of sensitive information. Experience in insider threat or threat management programs. Background in corporate investigations, counterintelligence, or cyber threat intelligence. Hands-on experience with OSINT tools and methodologies, including link analysis and dark web research. Proven ability to work in cross-functional environments with HR, Legal, Compliance, and Cyber teams. Knowledge of data classification, IP protection, and export-controlled data environments.
Benefits & Perks
check_circleMedical, dental, and vision insurancecheck_circleLife insurancecheck_circleShort-term and long-term disability insurancecheck_circle401(k) matchFlexible spending accounts
