Intern, Cyber Threat Intelligence (CTI) Consultant & Digital Forensics (DFIR)

Job description

Who are we? FTI Consulting is the leading global expert firm for organizations facing crises and transformations. We work with many leading international companies, law firms, banks and private equity firms, which entrust us with their most important issues. Whether it is resolving disputes, navigating crises, managing risk or optimizing performance, our teams respond quickly to complex situations to have a concrete and lasting impact. At FTI Consulting, you will work alongside leading experts in their field on large-scale, high-impact projects. From day one, you will be an integral part of a tight-knit team where you can bring real added value. You will evolve in an open and collaborative environment that values diversity, recognition, professional development and, most importantly, your journey. Are you ready to have an impact? Join FTI Consulting's Global Service Line Cyber Threat Intelligence, a global service line, and participate in its evolution. Our Cybersecurity practice brings together former national security and intelligence leaders, military officers and experts, consultants from the Big4, professionals from financial institutions and specialized cybersecurity companies. We work hand in hand with FTI's Investigations, Strategic Communications, Corporate Finance and Technology teams. Intelligence that changes the outcome of a crisis A ransomware actor publishes the data of an industrial group. An executive's identity is impersonated by a deepfake to validate a wire transfer. A board of directors needs to understand its exposure to state threats before an acquisition. A law firm needs an attribution that will hold up in court. In each of these cases, it is our team that is called. The Global Service Line CTI: three areas of expertise, one single team Where most players cover only one area, we merge cyber intelligence, corporate intelligence and geopolitical analysis, in the service of incident response and complex investigations. Cyber Threat Intelligence Intelligence-driven threat hunting Clear / deep / dark web research and monitoring Attack surface discovery and monitoring Credential & identity intelligence Infostealer investigations Vulnerability intelligence IOC research and dissemination Malware analysis & reverse engineering Detection engineering Corporate Intelligence Advanced OSINT research Profiling of threats targeting executives Third-party and supply chain monitoring Data leak analysis Digital Risk Protection Domain monitoring and takedown State Threats Geopolitical threat assessments Tracking of state actors (APT) Sectoral and regional threat landscapes Briefings for boards of directors Sanctions and export controls What makes our team unique At the heart of the most sensitive cases: we intervene under legal privilege, alongside FTI's litigation and investigations teams. A dual role: we are convinced by the dual expertise of investigation and intelligence Independence: we have no product to sell. Our recommendations are credible because they are not a sales argument. Rigor: sourcing, confidence levels and attribution designed to withstand scrutiny by a regulator or a court. What you will do From day one, you are a full member of the team, working on real, high-stakes cases. Cyber Threat Intelligence Produce tactical, operational and strategic intelligence from open, dark web and commercial sources Profile APT groups, cybercriminals and RaaS: TTPs, infrastructures, IOCs, detection recommendations Conduct infostealer-related investigations: analysis of logs, credentials, session cookies and stolen tokens, and trace back to the infected workstation and initial access Monitor log markets and Telegram channels, assess a client's and its executives' exposure, and prioritize remediation Conduct intelligence-driven threat hunting and contribute to detection engineering Apply MITRE ATT&CK, Diamond Model, Cyber Kill Chain and analysis standards (ACH, confidence levels) Incident response & forensics analysis Intervene on major incidents (ransomware, Active Directory compromise, CEO fraud, data leak) with international and multidisciplinary teams Conduct forensic analysis of workstations, servers and cloud environments: acquisition, timeline, Windows/Linux artifacts, logs, memory Reconstruct kill chains, identify patient zero, persistence and exfiltration mechanisms, and contribute to attribution Produce rigorous, traceable forensic findings that are defensible before a regulator or a court Threat actor profiling and intelligence Produce operational and executive deliverables under strong time constraints Corporate intelligence & Digital Risk Protection Conduct OSINT and dark web investigations on entities, individuals and third parties Identify executive exposure, brand impersonations, fraudulent domains and credential leaks Contribute to the development of our Digital Risk Protection offering and to takedown actions State Threats Use sources in the original language – Russian-speaking cybercriminal forums, Chinese ecosystems and publications – for first-hand intelligence Track state actors and analyze the impact of geopolitical tensions (Russia, China, Iran, Middle East…) on our clients Write sectoral threat landscapes, particularly for sectors subject to DORA and NIS2 Prepare intelligence briefings for executive committees and boards of directors CTI intelligence research & collection, Innovation, AI & tooling Contribute to CTI collection, research and production of bulletins Automate CTI workflows: collection, enrichment, correlation, triage (Python, APIs, Docker) Experiment with and deploy LLMs applied to intelligence: translation, summarization, entity extraction Contribute to our OpenCTI knowledge base shared across regions Other contributions Participate in support of other FTI Consulting engagements (e.g., cyber M&A due diligence, maturity assessments, Fraud & financial investigation, penetration testing, security audit …) Contribute to commercial proposals and to the visibility of the GSL Examples of engagements you could work on Incident response: An industrial group victim of ransomware: actor identification, monitoring & analysis of the DLS site, intelligence on the threat actor, executive report for the management committee and lawyers. Complex investigation: Compromise of an investment fund executive's iPhone by spyware in an M&A context: reconstruction of the timeline, attribution and deliverable usable under legal privilege. Strategic intelligence: Profile of an APT group targeting the European financial sector: TTP, infrastructure, IOC and detection recommendations, integrated into a TLPT/DORA testing exercise. Your role Contribute to IR, CTI and investigation cases alongside senior analysts Lead an innovation project 'AI applied to intelligence' Write analyses and participate in client presentations Your profile Bac+5 in progress, engineering school or university End-of-studies internship Excellent command of spoken and written English First experience (internship, Apprenticeship, project) in CTI, SOC, CERT or IR Basics in forensic analysis (Windows / Linux) Technical culture Python/Bash scripting OSINT and the Dark web CTF, personal research or publications appreciated Russian or Chinese (Mandarin) Technical environment & frameworks MITRE ATT&CK Velociraptor / Axiom / Autopsy / Volatility YARA / Sigma - Python / APIs Forensics (disk, memory, cloud) Docker / MongoDB / ELK OpenCTI / MISP Malware analysis & Reverse engineering What will make the difference Curiosity: you want to understand who is behind an attack, why and what will happen next. Multitasking: you can work on several engagements in parallel with different stakeholders. Analytical rigor: you distinguish a fact from a hypothesis and know how to express a confidence level. Composure: you remain precise under pressure, in the middle of a crisis and under tight deadlines. Discretion: you handle sensitive information with ethics and confidentiality. Communication: you adapt your message to a SOC analyst, a lawyer or a board of directors. Team spirit: you know that the best investigations are collective. What you will gain Cases that few professionals see in ten years of career: major crises, state actors, international litigation A rapidly evolving global service line, where your ideas and tools have a visible impact Direct mentorship by experts in intelligence, incident response and digital forensics International (Europe, United States, Asia-Pacific) and multidisciplinary exposure within FTI Access to most professional CTI tools and to cutting-edge AI projects For interns: a Full-time hire offered at the end of the internship to confirmed profiles. Additional information Contract type: End-of-studies internship Location: Paris, France - international engagements and collaboration (EMEA, US, APAC) On-call: Consultant only: on rotation, including some weekends (incident response). #EMEAJT #LI-EW1 About FTI Consulting FTI Consulting, Inc. is a leading international firm specialized in supporting organizations facing crises and transformations, with more than 8,100 employees across 32 countries and territories as of March 31, 2026. In certain jurisdictions, FTI Consulting's services are provided by separate legal entities, with their own capital and managed independently. The company generated revenue of $3.8 billion during fiscal year 2025. For more information, visit www.fticonsulting.com. FTI Consulting is an ethical employer and does not discriminate on the basis of race, color, origin, religion, physical or mental disability, sex, sexual orientation or age. With more than 8,100+ employees located in 32 countries and territories around the globe, we are the leading global expert firm for organizations facing crisis and transformation. Our experts have led organizations, shaped policy, driven investigations, managed crises, advised world leaders and built businesses from the ground up. Learn more about the work we do and how we're helping clients around the world turn their biggest challenges and opportunities into stories of success. Learn more about our impact. We are committed to creating an inclusive culture where our people can grow and achieve their full potential. To learn more about FTI Consulting, visit www.fticonsulting.com/careers and connect with us on Instagram and LinkedIn.