Senior Lead Threat Analyst (Black Lotus Labs)

Lumen Technologies • Us, VA,US

1d • $145,456 - $193,940 • Remote

About The Position

Lumen’s Black Lotus Labs is hiring a Senior Lead Threat Analyst to use Lumen’s global network visibility to hunt and investigate evolving malicious threats, scale threat discovery, produce mission-relevant intelligence, and support mitigations on large networks. The role works with security researchers, data engineers, malware reverse engineers, data scientists, customers, and other partners to investigate threats and develop automated detection approaches. The team uses technologies including Hadoop ecosystem tools (HBase, HDFS, Spark, Kafka, and Airflow), Elasticsearch and Redis clusters, Docker Swarm, malware analysis environments, honeypots, and approved AI-enabled tools.

The position is remote, with visits to the Herndon, Virginia office approximately twice per month. An active TS/SCI security clearance with CI Poly is required. The analyst will research adversary tools, techniques, and procedures; investigate cyber threat activity; automate analysis; and communicate findings and mitigation guidance. They will responsibly use and validate AI-assisted capabilities while maintaining analytical rigor and accountability.

Requirements

• Active TS/SCI security clearance with CI Poly.
• Effectively communicate complex domain-specific concepts to technical and non-technical audiences.
• Familiarity with adversary capabilities, infrastructure, and techniques for discovering, tracking, and defending against threats to customer networks.
• Experience using OSINT methods for investigations, including discovering novel threats in malware repositories.
• Python scripting experience and familiarity with distributed computing.
• Extensive experience hunting threat actors and developing algorithms and techniques to identify new threats from large datasets.
• Deep knowledge of network-based threats and identifying behaviors without attack payloads.
• Strong analytical thinking and ability to quickly learn new methods, tools, and programming languages.
• User-level experience in a Unix-based environment.
• Familiarity with extracting data through SQL.
• Strong writing skills to help share knowledge with the public.
• Demonstrable knowledge of several areas such as cybersecurity concepts, network protocols, firewalls, IDS/IPS systems, cyber threat hunting, malware analysis tools and techniques, cyber threat intelligence, common threat actor TTPs, application security concepts, and cloud security fundamentals.
• Ability to develop proficiency in unfamiliar technical domains through analytical skills, self-directed learning, and effective use of AI-assisted research and problem-solving tools.
• Ability to responsibly use AI-enabled tools for technical research, analysis, coding, documentation, and report development while maintaining professional skepticism and analytical rigor.
• Ability to evaluate, challenge, and validate AI-generated outputs before using them in customer-facing analysis, findings, or recommendations.

Nice To Haves

• Previous work experience with the Department of Defense, Intelligence Community, or other government agencies such as DHS, DOE, or VA.
• Experience with Spark and distributed computing.
• Experience developing automation and analysis in Python-based environments.
• Ability to provide direction to others and help them learn new topics.
• Experience using generative AI, AI-assisted coding, retrieval-augmented analysis, or agent-based workflows in cyber research, threat hunting, or intelligence production.
• Proficiency in analyzing NetFlow data to identify unusual patterns and potential security threats.
• Interest in trend analysis to uncover patterns and emerging threats and enable proactive defense strategies.
• Demonstrated ability to responsibly leverage AI-enabled tools in a regulated or mission-focused environment while maintaining data protection requirements, analytical integrity, and human accountability.

Responsibilities

• Research current threat actor tools, techniques, and procedures to automate detection.
• Work with cyber operators on in-depth investigations of cyber threat activity and provide mitigation guidance when requested.
• Automate investigations using Python scripting and data analysis, including visualization in Jupyter Notebooks and Grafana.
• Build and maintain trusted relationships with intelligence teams, law enforcement, and other external groups.
• Support customer requests for information concerning incidents and emerging threats.
• Use approved AI-enabled tools to accelerate research, coding, data exploration, documentation, and knowledge discovery, validating outputs through independent analytical judgment.
• Develop repeatable workflows combining analyst expertise, automation, and AI-assisted capabilities to improve investigative efficiency and analytical quality.
• Hunt threat actors and develop algorithms and techniques to identify new threats in large datasets.
• Communicate complex technical concepts clearly to technical and non-technical audiences and contribute to public-facing knowledge sharing.

Benefits

• Comprehensive package featuring a broad range of health, life, and voluntary lifestyle benefits and other perks supporting physical, mental, emotional, and financial wellbeing.
• Bonus structure may include short-term incentives, long-term incentives, and/or sales compensation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed