Consultant Cyber Threat Intelligence (CTI) & Digital Forensics (DFIR)

Job description

Who are we? FTI Consulting is the leading global expert firm for organizations facing crises and transformations. We work with many leading international companies, law firms, banks, and private equity firms, which entrust us with their most important issues. Whether resolving disputes, navigating crises, managing risk, or optimizing performance, our teams respond quickly to complex situations to have a concrete and lasting impact. At FTI Consulting, you will work alongside leading experts in their field on large-scale, high-impact projects. From day one, you will be an integral part of a close-knit team where you can add real value. You will grow in an open and collaborative environment that values diversity, recognition, professional development, and, most importantly, your career path. Are you ready to have an impact? Join FTI Consulting's Global Service Line Cyber Threat Intelligence, a global service line, and participate in its evolution. Our Cybersecurity practice brings together former national security and intelligence leaders, military officers and experts, consultants from the Big4, professionals from financial institutions, and specialized cybersecurity companies. We work hand in hand with FTI's Investigations, Strategic Communications, Corporate Finance, and Technology teams. Intelligence that changes the outcome of a crisis

A ransomware actor publishes the data of an industrial group. An executive's identity is spoofed by a deepfake to validate a wire transfer. A board of directors needs to understand its exposure to state threats before an acquisition. A law firm needs an attribution that will hold up in court. In each of these cases, our team is the one called. The Global Service Line CTI: three areas of expertise, one team

Where most players cover only one area, we combine cyber intelligence, corporate intelligence, and geopolitical analysis in service of incident response and complex investigations. Cyber Threat Intelligence

Intelligence-driven threat hunting

Clear / deep / dark web research and monitoring

Attack surface discovery and monitoring

Credential & identity intelligence

Infostealer investigations

Vulnerability intelligence

IOC research and dissemination

Malware analysis & reverse engineering

Detection engineering

Corporate Intelligence

Advanced OSINT research

Profiling of threats targeting executives

Third-party and supply chain monitoring

Data leak analysis

Digital Risk Protection

Domain monitoring and takedown

State Threats

Geopolitical threat assessments

Tracking of state actors (APT)

Sectoral and regional threat landscapes

Board briefings

Sanctions and export controls

What makes our team unique

At the heart of the most sensitive matters: we operate under legal privilege, alongside FTI's litigation and investigations teams. A dual role: we are convinced by the dual expertise of investigation and intelligence. Independence: we have no product to sell. Our recommendations are credible because they are not a sales pitch. Rigor: sourcing, confidence levels, and attribution designed to withstand scrutiny by a regulator or a court. What you will do

From day one, you are a full member of the team, working on real, high-stakes matters. Cyber Threat Intelligence

Produce tactical, operational, and strategic intelligence from open-source, dark web, and commercial sources

Profile APT groups, cybercriminal groups, and RaaS: TTPs, infrastructure, IOCs, detection recommendations

Conduct infostealer-related investigations: analysis of logs, credentials, session cookies, and stolen tokens, and tracing back to the infected workstation and initial access

Monitor log markets and Telegram channels, assess a client's and its executives' exposure, and prioritize remediation

Conduct intelligence-guided threat hunting and contribute to detection engineering

Apply MITRE ATT&CK, Diamond Model, Cyber Kill Chain, and analysis standards (ACH, confidence levels)

Incident response & forensic analysis

Respond to major incidents (ransomware, Active Directory compromise, CEO fraud, data leak) with international and multidisciplinary teams

Conduct forensic analysis of workstations, servers, and cloud environments: acquisition, timeline, Windows/Linux artifacts, logs, memory

Reconstruct kill chains, identify patient zero, persistence and exfiltration mechanisms, and contribute to attribution

Produce rigorous, traceable forensic findings that are defensible before a regulator or a court

Threat actor profiling and intelligence

Produce operational and executive deliverables under tight time constraints

Corporate intelligence & Digital Risk Protection

Conduct OSINT and dark web investigations on entities, individuals, and third parties

Identify executive exposure, brand impersonation, fraudulent domains, and credential leaks

Contribute to the development of our Digital Risk Protection offering and to takedown actions

State Threats

Use sources in their original language – Russian-speaking cybercriminal forums, Chinese ecosystems and publications – for first-hand intelligence

Track state actors and analyze the impact of geopolitical tensions (Russia, China, Iran, Middle East…) on our clients

Write sectoral threat landscapes, particularly for sectors subject to DORA and NIS2

Prepare intelligence briefings for executive committees and boards of directors

CTI intelligence research & collection, Innovation, AI & tooling

Contribute to CTI collection, research, and bulletin production

Automate CTI workflows: collection, enrichment, correlation, triage (Python, APIs, Docker)

Experiment with and deploy LLMs applied to intelligence: translation, summarization, entity extraction

Contribute to our OpenCTI knowledge base shared across regions

Other contributions

Participate in support of other FTI Consulting engagements (e.g., cyber M&A due diligence, maturity assessments, Fraud & financial investigation, penetration testing, security audit …)

Contribute to commercial proposals and to the visibility of the GSL

Examples of engagements you could work on

Incident response: An industrial group victim of ransomware: actor identification, monitoring & analysis of the DLS site, intelligence on the threat actor, executive report for the management committee and lawyers. Complex investigation: Compromise of an investment fund executive's iPhone by spyware in an M&A context: reconstruction of the timeline, attribution, and deliverable usable under legal privilege. Strategic intelligence: Profile of an APT group targeting the European financial sector: TTP, infrastructure, IOC, and detection recommendations, integrated into a TLPT/DORA testing exercise. Your role

Lead workstreams autonomously, from collection to reporting

Be a direct point of contact for clients, lawyers, and IR teams

Supervise interns and contribute to GSL methodologies

Participate in business development and proposals

Your profile

Master's degree (Bac+5), engineering school or university

1 to 6 years of experience

Excellent command of spoken and written English

Excellent analytical writing in French

Experience in CTI, IR, CERT, or investigations (consulting, agency, vendor, CERT/CSIRT)

Command of frameworks and technical culture

Confirmed practice of forensic analysis in an incident response context

Certifications (GCTI, GCFA, GREM, OSCP…) appreciated

Russian or Chinese (Mandarin)

Technical environment & frameworks

MITRE ATT&CK Velociraptor / Axiom / Autopsy / Volatility YARA / Sigma - Python / APIs Forensics (disk, memory, cloud) Docker / MongoDB / ELK OpenCTI / MISP Malware analysis & Reverse engineering

What will make the difference

Curiosity: you want to understand who is behind an attack, why, and what will happen next. Multitasking: you can work on several engagements in parallel with different stakeholders. Analytical rigor: you distinguish a fact from a hypothesis and know how to express a confidence level. Composure: you remain precise under pressure, in the middle of a crisis, and under tight deadlines. Discretion: you handle sensitive information with ethics and confidentiality. Communication: you adapt your message to a SOC analyst, a lawyer, or a board of directors. Team spirit: you know that the best investigations are collective. What you will gain

Matters that few professionals see in ten years of career: major crises, state actors, international litigation

A rapidly evolving global service line, where your ideas and tools have a visible impact

Direct mentoring by experts in intelligence, incident response, and digital forensics

International (Europe, United States, Asia-Pacific) and multidisciplinary exposure within FTI

Access to most professional CTI tools and to cutting-edge AI projects. Additional information

Contract type: Full-time

Location: Paris, France - international assignments and collaboration (EMEA, US, APAC)

On-call: rotating, including some weekends (incident response). #EMEAJT #LI-EW1 About FTI Consulting

FTI Consulting, Inc. is a leading international firm specializing in supporting organizations facing crises and transformations, with more than 8,100 employees across 32 countries and territories as of March 31, 2026. In certain jurisdictions, FTI Consulting services are provided by separate legal entities, with their own capital and managed independently. The company generated revenue of $3.8 billion in fiscal year 2025. For more information, visit www.fticonsulting.com. FTI Consulting is an ethical employer and does not discriminate on the basis of race, color, origin, religion, physical or mental disability, sex, sexual orientation, or age. With more than 8,100+ employees located in 32 countries and territories around the globe, we are the leading global expert firm for organizations facing crisis and transformation. Our experts have led organizations, shaped policy, driven investigations, managed crises, advised world leaders and built businesses from the ground up. Learn more about the work we do and how we're helping clients around the world turn their biggest challenges and opportunities into stories of success. Learn more about our impact. We are committed to creating an inclusive culture where our people can grow and achieve their full potential. To learn more about FTI Consulting, visit www.fticonsulting.com/careers and connect with us on Instagram and LinkedIn.