# Cyber Intelligence Analyst Internship at CryptoMize A Cyber Intelligence Analyst intern at CryptoMize turns raw threat input — harvested indicators, channel chatter, field captures — into actor-level intelligence for live client engagements, working the seam between the security-operations and OSINT cells where threat data becomes the material strategists brief from. Apply now for the Cyber Intelligence Analyst Internship in Delhi at CryptoMize — a 6-month certified program on a rolling, always-hiring intake. Cyber Intelligence analysts here work on real engagement threat data across the five intelligence domains: perception baselines, political campaign threats, brand impersonation, fraud detection, and disinformation. The role sits in the cybersecurity and intelligence cells, working alongside the security operations and OSINT teams on the S3-SENTINEL and CLAIRVOYANCE CX platforms, with the same operational model as every other CryptoMize cell: capacity is hired ahead of the next engagement, not after. From the opening fortnight you sit inside the real workflow — feeds normalized, indicators correlated, assessments written — and the work that ships under your name during the program is the work that decides the offer that follows it. This page is the complete internship description: the craft, the eligibility, the six-month path, and the selection process. ## Facts - Location: New Delhi (HQ), CDR Building, Chhatarpur - Type: 6-month internship, certification provided - Availability: immediate, rolling intake (always hiring) - Compensation: discussed at screening ## What you will actually do - Consume the collection layer's output — curated feeds, harvested indicators, field reports — and turn raw input into actor-level threat intelligence for the cell's engagements", 'Correlate indicators across feeds to produce IOC databases and threat-actor profiles specific to client engagements - Write threat-assessment reports for political, healthcare, and enterprise clients that the strategist takes to briefings within 24–48 hours of collection - Own the severity model — separating credible threats from background noise across the client portfolio - Brief the security-operations team on emerging threat patterns that affect client engagement posture - Carry a personal investigator role on one client engagement, building a portfolio of assessed threats by month three - Track an actor from first indicator to named profile — infrastructure, personas, and timing patterns compiled into the dossier the strategist carries - Grade every escalation against the severity model before it moves upward, the discipline that keeps the cell’s signal credible when volume spikes - Rehearse the briefing loop: your written assessment delivered verbally to the security lead until the question rounds stop finding gaps ## Skills - Threat-actor profiling — TTPs, infrastructure, motivations, the analyst mindset that ties indicators to actor-level understanding - OSINT-collection discipline — sourcing, verification, and the trail-building that lets a finding be re-verified months later - Indicator correlation — pivoting across feeds, spotting the same infrastructure or persona across unrelated sources - Reporting — short situational reports and longer-form threat assessments that the strategist takes to clients unchanged - MISP fluency — IOC store, galaxy clusters, correlation engine, feed integration - Tooling fluency — IOC extraction patterns, REST integrations into the MISP stack, and the query habits that make pivots fast - Dark-web exposure reading — working safely from collection-layer captures without burning analyst access - Claim triage — channel chatter graded against confirmed reporting before anything is escalated as threat - Influence-operations awareness — coordinated inauthentic behavior recognized as a threat vector alongside the technical ones - NDA-grade indicator handling — chain of custody from first sighting to client brief, kept airtight - Cross-language threat material routed through the regional desks when an engagement’s actors operate outside English - Closed-loop briefing — the security team takes your report into the client briefing unchanged ## Tools - MISP (Malware Information Sharing Platform) — the cell’s primary IOC store and correlation engine - MISP galaxy cluster model for threat-actor and campaign-taxonomy classification - Python 3.11 + pandas for IOC aggregation and pivot queries - MISP-feed integration — STIX/TAXII import pipelines and the feed-credibility scoring model - OSINT framework — Maltego for link analysis, Shodan-class exposure scanning, the cell’s custom monitoring stack ## Questions and answers ### What does a Cyber Intelligence Analyst intern do at CryptoMize? A Cyber Intelligence Analyst intern opens and maintains the threat-intel pipeline, correlates indicators across feeds to produce IOC databases and threat-actor profiles, and writes threat-assessment reports that the strategist takes to client briefings within 24–48 hours of collection. The cell runs the same operational model as every other CryptoMize cell: capacity is hired ahead of the next engagement, not after. ### What tools will I use as an intern? MISP as the cell’s primary IOC store and correlation engine, MISP galaxy clusters for threat-actor and campaign classification, Python and pandas for IOC aggregation and pivot queries, and the OSINT framework — Maltego for link analysis, Shodan-class exposure scanning, and the cell’s custom monitoring stack. No prior fluency is assumed: the stack is taught in-house during Month 1, and every output you produce on it carries mentor review until the capstone. ### What is the eligibility for the Cyber Intelligence Analyst Internship? Final-year students or recent graduates in cybersecurity, computer science, IT, or equivalent self-taught analysts with demonstrated ability. No diploma is mandatory — the evaluation runs on demonstrated OSINT and indicator work, not paperwork. Basic scripting familiarity (Python or equivalent) is expected on arrival; the analytical depth, the tooling, and the briefing craft are what the six months teach. ### Is the internship paid? Compensation is discussed during the screening process and depends on demonstrated skill, engagement classification, urgency, and track record. We deliberately do not publish figures — each intern is evaluated individually. ### What is the selection process? A short application, a small OSINT task on a realistic engagement brief, and a final interview with the intelligence and security leads. The whole cycle typically completes within two weeks because intake is rolling and the cell is staffed ahead of demand. ### Why does a digital agency hire Cyber Intelligence Analysts? CryptoMize serves political, enterprise, and healthcare-sector clients whose threat surface includes brand impersonation, campaign interference, fraud operations, and disinformation campaigns. The cyber intelligence cell exists to support those engagements with the same analytical depth the OSINT and strategic-intelligence cells bring to their domains — the difference is the object: actors, infrastructure, and intent rather than public-record landscape. ### What does a typical week look like on this desk? Mornings run the feed triage queue and grade overnight collections against the severity model; midday is correlation work — pivoting indicators, extending actor profiles, closing the loops an overnight capture opened; afternoons alternate between writing, mentor markup, and the cell’s threat-brief review where the day’s escalations are defended out loud. ### How does this seat differ from the OSINT analyst seat? The OSINT cell owns collection — sweeps, verification, source-trail discipline across public and semi-public ground. This desk owns what happens after: the threat-specific read where collected material becomes actor profiles, IOC sets, and graded assessments. The two cells share engagements, tooling, and review cadence, but the craft seats are distinct. Apply: https://cryptomize.com/careers/internship/apply/