Cyber Security Analyst - Threat Researcher

SMBC•Charlotte, NC

1d•Hybrid

About The Position

As an Associate-level Cyber Security Analyst - Threat Researcher, you will independently research assigned cyber threats, vulnerability exploitation pathways, and AI-augmented attacks within SMBC Group’s Cyber Threat Intelligence program, with prioritization and review from senior team members. You will document evidence and analytical confidence, develop visual attack pathway models, and support SOC, vulnerability management, and security engineering teams in identifying detection, threat hunting, and mitigation opportunities relevant to SMBC Group’s technology environment and business services. The role researches threat actors, malware, campaigns, vulnerability exploitation, and AI-assisted activity; models evidence-based attack pathways; uses intelligence and security tools to analyze and communicate findings; and collaborates with security teams to validate exposure assumptions and inform priorities. Implementation of resulting controls and remediation remains with the responsible teams.

Requirements

Three or more years of experience in cyber threat intelligence, threat research, or threat hunting within a SOC or information security program.
Understanding of adversary tactics, techniques, and procedures and familiarity with MITRE ATT&CK.
Ability to assess vulnerability advisories and exploitation reporting, identify exploitation prerequisites, and explain implications for enterprise exposure and defensive controls.
Ability to develop clear visual attack pathways or kill chain diagrams.
Familiarity with open-source or commercial threat intelligence and security telemetry used in threat analysis.
Strong analytical, written, and verbal communication skills, including evaluating source credibility, documenting evidence and analytical confidence, and managing assigned research priorities.

Nice To Haves

Bachelor’s degree in cybersecurity, computer science, information technology, or a related field.
Experience reviewing technical exploitation research or supporting authorized vulnerability validation in a controlled lab environment.
Familiarity with adversary analysis approaches such as the Diamond Model, Cyber Kill Chain, or attack trees.
Familiarity with KQL or Python for telemetry analysis, intelligence enrichment, or basic workflow automation.
Experience researching AI-augmented cyber threats and distinguishing demonstrated capabilities from speculative claims.
Experience in financial services or another regulated industry.
Relevant threat intelligence or security certifications, such as GCTI or CTIA.

Responsibilities

Research assigned threat actors, malware, and campaigns to identify attack patterns and adversary tactics, techniques, and procedures (TTPs), including emerging threats relevant to financial services.
Analyze open-source and commercial intelligence and internal telemetry to inform threat models, documenting source credibility, analytical confidence, and intelligence gaps.
Assess vulnerability advisories, proof-of-concept availability, reported exploitation, and remediation status to identify exploitation prerequisites, potential exposure, and compensating controls relevant to SMBC Group.
Research AI-assisted reconnaissance, social engineering, impersonation, and malicious code development, distinguishing documented adversary activity from speculative claims, including claims of autonomous capability.
Develop and maintain evidence-based visual attack pathways mapped to MITRE ATT&CK techniques, incorporating vulnerability exploitation and AI augmentation where relevant and distinguishing observed behavior from analytical or hypothetical scenarios.
Map exploitation prerequisites, potential privilege escalation and lateral movement, control dependencies, and business impact to observable activity and defensive intervention points, distinguishing exploit availability from evidence of enterprise compromise.
Use attack pathways to support detection recommendations, threat hunt hypotheses, authorized simulations, and tabletop exercises, including financial-system scenarios where assigned.
Use available threat intelligence platforms and SIEM data to support research, collection, and analysis.
Use approved visualization tools to create attack pathway diagrams and ATT&CK Navigator to map technique coverage.
Support intelligence enrichment and workflow improvements, including basic scripting where applicable.
Produce clear, actionable intelligence reports and visualizations for technical and executive audiences.
Present research findings and attack pathways in team briefings and contribute to planning discussions.
Work with SOC analysts, vulnerability management, asset owners, security engineering, security testing, cyber resilience, and threat modeling teams to validate exposure assumptions and inform detection, threat hunting, and remediation priorities; implementation remains with the responsible teams.