Brookfield Asset Management
Senior Analyst – Cyber Threat Intelligence
Toronto, Ontario · Senior
Sponsorship not specified$105k-$115kDetected 1 day ago
TypeScriptPythonPowerShellLLMsCybersecuritySIEMSOC OperationsIncident ResponseAccessibilityIntellectual PropertyCadenceResearchLeadershipCommunicationCISSP
Stay score
odds of building a lasting career here
50Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role90
Entry-level history0
PERM / green-card track0
Lottery odds (Level II)66
Fits your clock70
Sponsors, but it's cap-subject — you still face the weighted lottery (~30% per draw at Level II). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →Employer immigration record
from this employer's Department of Labor filings
Green-card filing pattern in this occupation
Context, not a finding about this posting: of this employer's 4 green-card filings in this occupation, 100% were for a worker who already held the job.
Files H-1B transfers
2 transfer filings in the last year, covering 2 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- The Senior Analyst works closely with Security Operations, Incident Response, Vulnerability Management, Legal, Privacy, and Fraud teams to translate external threat activity into actionable security and business outcomes.
- Identify and track threat actors, ransomware groups, initial access brokers, malware operators, fraud networks, and criminal collectives relevant to Brookfield's industry, profile, and operations.
- Research and investigate stolen credentials, compromised accounts, data leaks, ransomware activity, initial access sales, vulnerability exploitation, malware campaigns, phishing operations, business email compromise, and fraud schemes.
Responsibilities
- Collect, validate, enrich, and analyze intelligence from OSINT, commercial intelligence sources, internal security data, and specialized cybercrime sources
- Develop and maintain threat actor profiles covering motivations, capabilities, tactics, techniques, and procedures (TTPs), infrastructure, targeting patterns, and historical activity.
- Support Security Operations and Incident Response teams with external threat context during active investigations, ransomware events, data breaches, fraud cases, and third-party compromises.
- Validate claims made by threat actors regarding alleged data theft or compromise through appropriate intelligence sources.
Requirements
- Three to seven years of experience in cyber threat intelligence, cyber investigations, SOC operations, incident response, digital forensics, or security research.
- Experience conducting OSINT and investigative research using multiple sources and analytical techniques.
- Strong understanding of threat actor behavior, cybercrime business models, common attack methodologies, and the broader threat landscape.
- Experience producing intelligence reports and briefings for technical and executive audiences.
- Experience supporting time-sensitive investigations or incidents and working within defined escalation procedures.
- Strong analytical and investigative mindset, with the ability to evaluate source credibility and distinguish fact from speculation.
- Ability to translate complex technical findings into concise, actionable intelligence for technical and non-technical stakeholders.
- Working knowledge of MITRE ATT&CK, Cyber Kill Chain, Diamond Model, or similar analytical frameworks.
- Working knowledge of generative AI technologies, AI-enabled threat activity, synthetic media risks, and responsible use of AI-assisted analytical tools.
Nice to have
- Experience tracking ransomware groups, initial access brokers, credential theft operations, data extortion groups, malware-as-a-service, or underground marketplaces.
- Experience with cyber threat intelligence platforms, dark web monitoring tools, SIEM technologies, EDR/XDR platforms, and OSINT tooling.
- Understanding of cryptocurrency and blockchain activity relevant to cybercrime investigations.
- Familiarity with threat intelligence standards and formats such as STIX/TAXII.
- Experience conducting investigations involving credential exposure, ransomware, data extortion, fraud, phishing, business email compromise, or third-party compromise.
- Familiarity with AI-security risks and recognized guidance such as the NIST AI Risk Management Framework and Generative AI Profile.
- Relevant certifications such as CTIA, GCTI, GCFA, GCIH, GCIA, CISSP, or Security+.
- Additional Requirement
Compensation
- Salary Range: C$105K - $115K
Company info
- New Position
- Brookfield is committed to maintaining a Positive Work Environment that is safe, respectful; our shared success depends on it.
- We do not tolerate workplace discrimination, violence or harassment.
- We are proud to be an Equal Opportunity Employer and make employment decisions based on qualifications, merit, and business needs, without regard to any characteristic protected by applicable law.
- As part of this commitment, we provide barrier-free and accessible employment practices in accordance with the Accessibility for Ontarians with Disabilities Act (AODA) and applicable human rights legislation.
- If you require a Human Rights Code-protected accommodation at any stage of the recruitment process, please let us know when contacted, and we will work with you to meet your needs.
Apply directly at Brookfield Asset Management →Create a free account for alerts like thisView Brookfield Asset Management immigration profile
This listing is sourced directly from Brookfield Asset Management's careers page and normalized into a canonical job model.