ZACHARY LANZ
|
About Me
Cyber Threat Intelligence specialist focused on building and maturing CTI programs, integrating intelligence across security and business stakeholders, and translating threat landscapes into strategic, actionable outcomes. Currently consulting at Ernst & Young.
I connect geopolitical events and global threat dynamics to the cyber risks that matter most to an organization. My work bridges tactical indicators and strategic intelligence, helping leadership understand their priority threats, assess risk, and take decisive action.
What I Do
CTI Program Development
Building and maturing CTI programs end-to-end — intelligence requirements, collection strategies, analytic tradecraft, product catalogs, and stakeholder integration.
Intelligence Integration
Integrating CTI across security functions and business units — from SOC and vulnerability management to crisis management and executive communications.
Geopolitical & Cyber Analysis
Connecting global events and threat dynamics to organization-specific cyber risk and priority threats.
Strategic Intelligence
Translating tactical indicators into strategic outcomes — helping leadership assess risk and take decisive action.
Adversary Profiling
APT tracking, threat actor attribution, and TTP analysis using structured analytic techniques.
OSINT Collection
Open-source intelligence collection across surface, deep, and dark web sources using premium investigation platforms.
Infrastructure Tracking
Adversary infrastructure analysis, domain pivoting, and network mapping to uncover threat actor operations.
Threat Activity Clustering & Attribution
Grouping related intrusion activity into clusters based on shared TTPs, infrastructure, and targeting patterns to enable attribution and tracking.
Intrusion Analysis
Analyzing intrusion data using structured frameworks like the Diamond Model and Kill Chain to understand adversary operations and inform defensive action.
Threat Hunting
Intelligence-driven hypothesis generation and proactive hunt operations to detect adversary activity before automated alerting.
Experience Integrating CTI With:
Tools & Platforms
OpenCTI
ThreatConnect
MISP
Recorded Future
Mandiant
Splunk
CrowdStrike Falcon
Maltego
DomainTools
VirusTotal
Shodan
Silent Push
Python
PowerBI
Tableau
STIX/TAXII
MITRE ATT&CK
Get in Touch
contact.sh
βββ(systemγΏcontact)-[~]
ββ$ cat contact_info.txt
ββ$ echo "Status: Available for consulting and collaboration"
Status: Available for consulting and collaboration
ββ$ _