Description

JOB DESCRIPTION

Intelligence Analyst

The Role

The Intelligence Analyst is the senior analytical seat in the operation. You monitor an all-hazards picture for client critical infrastructure across multiple sites in a disperse geographical areas severe weather, grid and utility disruption, civil unrest and protest activity, crime and targeted violence, unauthorized drone activity, transportation and supply disruption, wildfire, seismic activity, and public health events. You calculate what each event actually threatens, and you communicate that judgment to the people who act on it.

Key Responsibilities

All-Hazards Monitoring
• Monitor a defined portfolio of sites continuously for natural, technological, human-caused, and geopolitical hazards.
• Run open-source intelligence collection across news, government, utility, meteorological, transportation, and social sources - and verify before you report.
• Maintain persistent awareness of regional conditions surrounding each assigned site, including power and water availability, road and airspace status, and local civil activity.
• Track developing situations through resolution and update stakeholders as the picture changes.

Risk Calculation and Assessment
• Assess every event against three factors - proximity to the site, severity of the hazard, and incident or risk type - and produce a defensible risk determination from them.
• Apply the program's scoring and threshold criteria consistently, so the same event produces the same call regardless of who is on shift.
• Distinguish credible threats from noise. Explain the reasoning behind each call, not just the conclusion.
• Identify second-order effects: what a hazard disrupts downstream, and which sites inherit the consequence.
• Recommend threshold and criteria adjustments to leadership when event patterns show the current settings are miscalibrated.

Stakeholder Communication and Escalation
• Notify the right stakeholders at the right time, matched to proximity, severity, and risk type - site leadership, regional leadership, operations, and client security leadership.
• Write and deliver alerts that state the hazard, the affected site, the assessed impact, and the recommended action. Bottom line first.
• Escalate through defined paths without delay, and confirm receipt on time-critical notifications.
• Serve as the analytical voice during crisis coordination - give leadership the picture they need to decide, in the time they have to decide it.
• Brief technical and non-technical audiences with the same clarity.

Intelligence Production and Reporting
• Produce daily intelligence briefs covering the previous 24 hours and the day ahead, written for site and regional leads.
• Produce weekly summaries with emerging indicators and a forward outlook.
• Answer requests for information with sourced, analyst-produced assessments inside agreed turnaround times.
• Build trend analysis that identifies recurring risk exposure across the portfolio and informs mitigation planning.
• Document every assessment so it holds up on later review.

Program Support
• Support drills, tabletop exercises, and after-action reviews.
• Contribute to standard operating procedures, escalation matrices, and notification templates - and keep them current as conditions change.
• Work inside client systems, procedures, and reporting standards. One process, not a second one to reconcile.

Required Qualifications
• Five or more years of intelligence analysis, threat monitoring, or security operations experience - or equivalent practical experience.
• Bachelor's degree in intelligence studies, international relations, emergency management, criminal justice, geography, or a related field - or equivalent practical experience.
• Demonstrated background in one or more of: military or government intelligence, law enforcement, corporate security, or emergency management.
• Working command of structured analytic techniques and cognitive bias mitigation.
• Open-source intelligence tradecraft, including source verification and digital hygiene.
• Proven written clarity under time pressure. Bottom-line-up-front writing built for executive decisions.
• Experience assessing risk by proximity, severity, and hazard type, and escalating on defined criteria.
• Proficiency with commercial intelligence and event-monitoring platforms, geospatial and mapping tools, mass notification systems, and case management platforms.
• Availability for any shift in a 24/7/365 operation, including nights, weekends, and holidays.
• Ability to pass all pre-employment screening and meet local licensing requirements.

Preferred Qualifications
• Experience supporting data centers, critical infrastructure, or a multi-site enterprise portfolio.
• Experience in multi-national operations.
• Experience building or tuning risk scoring models, alert thresholds, or geofenced monitoring criteria.
• Crisis management or emergency operations center experience.
• Industry certification - ASIS CPP or PSP, ATAP Certified Threat Manager, GIAC Open Source Intelligence (GOSI), FEMA Professional Development Series, or equivalent.
• Experience mentoring or training analysts.

Key Competencies

All-Hazards Analysis

Risk Calculation

Stakeholder Communication

OSINT Tradecraft

Situational Awareness

Decision-Making Under Pressure

Analytic Writing

Escalation Judgment

Attention to Detail

Work Environment
• On-site at a designated client Security Operations Center. This is an embedded role - you work inside the client's operation, in their systems and their workspace, under M1 Global.
• 24/7/365 operation with no scheduled downtime. Shift assignment is set by site and may include nights, weekends, and holidays.
• Sustained console work with concurrent monitoring across multiple systems and time zones.
• Direct daily coordination with site security teams, dispatch personnel, regional leadership, and client stakeholders.
• Senior M1 Global intelligence leadership is on call for complex events, deep-dive analysis, and surge support.

Requirements

Ability to obtain a VA state security license

Ability to obtain CPR certification

Availability for any shift in a 24/7/365 operation, including nights, weekends, and holidays.