Manager, Threat Intelligence
Employer not yet confirmed · United States
Kroll Cyber Threat Intelligence (CTI) is seeking an experienced Manager, Cyber Threat Intelligence to lead and develop a team of L2 and L3 Associates delivering complex intelligence and investigative services to Kroll clients globally. The Manager will also oversee CTI's summer internship program, providing interns with structured exposure to intelligence research, investigative tradecraft, analytical methodologies and professional development.
The Manager will serve as a critical link between CTI leadership and the Associate team, providing day-to-day management, investigative oversight, quality assurance and professional development. The position will also carry significant client-facing and commercial responsibilities, including engagement scoping, proposal development, resource estimation, business development and identification of opportunities to expand Kroll's CTI services.
The position is designed as a working manager role, requiring the individual to balance people leadership with investigative expertise, client engagement and commercial responsibility.
Key Responsibilities:
Team Leadership and Development
- Provide direct day-to-day leadership, coaching and development for L2 and L3 Associates within Kroll CTI.
- Allocate investigative assignments based on complexity, client requirements, analyst capability, resource availability and professional-development objectives.
- Manage workloads and priorities across concurrent client matters and internal initiatives.
- Review analyst research, investigative methodologies, analytical judgments and written deliverables to ensure they meet Kroll quality standards.
- Establish clear expectations for investigative rigor, documentation, source evaluation, analytical confidence and client-ready communication.
Deep & Dark Web Investigations
- Supervise and, where appropriate, lead complex investigations across the open, deep and dark web, including underground forums, marketplaces, leak sites, illicit communities, messaging platforms, credential repositories and other restricted-access sources.
- Oversee investigations involving threat actors, ransomware and extortion activity, leaked or stolen information, compromised credentials, fraud, executive exposure and other emerging cyber threats.
- Guide analysts in developing collection plans, investigative hypotheses, search strategies, personas, source lists, keywords and monitoring methodologies.
- Ensure findings are properly corroborated and evaluated for source reliability, credibility, relevance and analytical confidence.
- Ensure investigative activities adhere to applicable Kroll policies, legal requirements, ethical standards and client confidentiality requirements.
- Maintain appropriate investigative documentation and defensible analytical and evidentiary trails.
- Convert complex investigative findings into clear assessments of client risk and recommended actions.
Due Diligence and Investigative Intelligence
- Lead CTI support for complex cyber due diligence and investigative matters, working with Kroll cyber, investigative, financial, legal and advisory professionals as appropriate.
- Direct cyber-risk and digital-exposure research involving organizations, executives, transactions and other subjects of interest.
- Integrate deep and dark web intelligence, OSINT, digital footprint analysis and other investigative techniques to develop comprehensive intelligence assessments.
- Identify cyber threats, historical exposures, compromised information, threat actor interest and other indicators that may materially affect a transaction or client decision.
- Translate fragmented technical and investigative information into defensible intelligence assessments for executives, investors, counsel and other decision-makers.
- Coordinate CTI support with other Kroll capabilities when matters require a multidisciplinary investigative approach.
Protective Intelligence
- Manage protective intelligence engagements involving executives, high-net-worth individuals and other persons requiring enhanced security awareness or protection.
- Oversee assessments of publicly and illicitly available personally identifiable information, digital exposure, impersonation risk, social-media exposure, unusual online interest and emerging threats.
- Direct digital-footprint, threat-actor and online behavioral research associated with protective-intelligence requirements.
- Identify the intersection between cyber, digital and potential physical risks and escalate material findings appropriately.
- Coordinate CTI findings with Kroll security, investigative and risk professionals where physical and cyber risks converge.
- Ensure protective-intelligence findings are translated into clear risk assessments and practical mitigation recommendations.
Business Development, Scoping & Commercial Support
The Manager will have an active role in growing Kroll CTI and transforming client requirements into technically sound, operationally achievable and commercially viable engagements.
Responsibilities will include:
- Participate in client discovery and scoping discussions to understand business objectives, investigative questions, threat concerns, intelligence requirements, timelines and desired outcomes.
- Advise clients and internal Kroll stakeholders on the appropriate CTI capabilities and investigative methodologies for addressing identified requirements.
- Translate client requirements into clearly defined scopes of work, including investigative methodology, collection requirements, deliverables, assumptions, timelines and resource requirements.
- Develop scopes for Deep and Dark Web investigations, cyber due diligence, protective intelligence, executive exposure assessments, threat actor investigations, persistent monitoring and bespoke intelligence engagements.
- Estimate analyst hours, level of effort, technology requirements and appropriate L2, L3 and Manager staffing to support engagement pricing and profitability.
- Participate in client presentations and articulate Kroll CTI's capabilities, methodologies and value proposition to technical and executive stakeholders.
Summer Internship Program
The Manager will have primary responsibility for the Kroll CTI Summer Internship Program, including:
- Develop a structured internship curriculum with defined learning objectives and measurable outcomes.
- Select investigative and intelligence assignments appropriate for intern participation.
- Assign mentors and coordinate support from L2 and L3 Associates.
- Provide foundational training in OSINT, Deep and Dark Web research, source evaluation, intelligence analysis and professional report writing.
- Create supervised opportunities for interns to contribute to appropriate due diligence, protective intelligence and DDW investigations.
- Conduct regular check-ins, coaching sessions, performance feedback and end-of-program evaluations.
- Ensure internship activities comply with applicable Kroll information-security, privacy, ethics and client-confidentiality requirements.
- Identify high-performing interns as potential candidates for future L2 Associate opportunities, establishing the internship program as an intentional component of Kroll CTI's talent pipeline.
Client and Engagement Management
- Serve as a primary quality-control and escalation point for Associate-led investigations.
- Review significant client deliverables prior to release.
- Participate in and, as appropriate, lead client calls, investigative briefings and intelligence presentations.
- Manage client expectations concerning scope, deliverables and timelines.
- Maintain clear communication with clients and internal Kroll stakeholders throughout the engagement lifecycle.
- Capture lessons learned and identify opportunities to improve investigative methodologies, operational procedures and service delivery.
Required Experience and Qualifications:
- Approximately 4