Senior Threat Intelligence Analyst -UK

Team Cymru

1d•Remote

About The Position

Join the mission to make the digital world safer. Team Cymru is the leader in Internet Threat Intelligence. Our unique and global insight empowers an amazing team of analysts to develop industry leading intelligence that is critical to the success of our customer's cyber security efforts. Team Cymru is an ardent supporter of the Threat Intelligence community. We enable industry collaboration by hosting exclusive conferences each year. Our team members actively participate in working groups, attend industry events, and work directly with fellow community peers. Team Cymru analysts make a difference every day, leading in the battle against those intent on harming others. We are passionate about our mission, and we are looking for an additional teammate who shares in that passion. Do you have a strong background in analytic tradecraft, deductive reasoning, and critical thinking? Would you like to have access to our industry leading threat intelligence data? Are you a proven teammate, mentor, and technical leader? Would you like to join the battle and make a difference in the world? If so, opportunity knocks. Team Cymru analysts work on research and reporting pertaining to our customers' security and intelligence requirements, empowering them to complete their mission effectively and efficiently. Additionally, our analysts undertake research into other threats and work closely with our engineering teams in the development of our world class analytical tools, data analytics systems, and analysis automation, as well as adding to the body of knowledge of those threats. As a Senior Threat Intelligence Analyst, you will provide that vital bridge between technical and strategic intelligence research, writing for both practitioner and senior leadership audiences to understand the impact of the threat, while explaining the technical details and rationale behind those assessments, the best of both worlds!

Requirements

5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst
Exceptional oral and written communication skills, with the ability to produce customer-facing intelligence reports under time pressure.
Experience using structured analysis techniques, estimative language, and confidence levels is preferred
Proven track record of leading complex analytical projects or investigations, including the ability to manage multiple concurrent work streams
Well-developed analytical, deductive reasoning, and critical thinking skills; comfortable forming assessments from incomplete or ambiguous data
Proven ability to work effectively within a distributed, remote team environment, including willingness to conduct peer review and share tradecraft knowledge
Experience tracking APT, nation-state, or cybercriminal actors, with the ability to contextualize their activity within the broader geopolitical or strategic landscape
Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates
Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP)
Demonstrated knowledge of operating system concepts, including experience developing and contextualizing indicators of compromise and understanding their deployment in host and network-level detection architectures
Working proficiency in SQL and querying and analyzing large disparate datasets
Strong familiarity with common OSINT platforms and research techniques

Nice To Haves

A Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent
Subject Matter Expert (SME) for a specific regional or threat actor group, with demonstrable depth in their TTPs, infrastructure patterns, and campaign history
Programming or scripting proficiency, preferably Python, for data processing, automation, or tool development
Confident and skilled public speaker with experience presenting technical research to large audiences at industry conferences or similar forums
Familiarity with using AI systems to rapidly prototype analytical tools and develop proof-of-concept projects
Hands-on experience managing remote Linux servers and engineering custom Proof-of-Concept tools to extract, simulate, or generate unique threat data
Working understanding of malware analysis and network analysis: YARA, Zeek, Suricata, Sandbox reporting
Exposure to malware reverse engineering, including static and dynamic analysis techniques and common tooling (e.g. Ghidra, IDA Pro, x64dbg)
Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors

Responsibilities

Conduct extensive, proactive research into threat actors, malware families, campaigns, and evolving TTPs to maintain relevance and deepen Team Cymru's body of knowledge
Investigate and present operational and strategic intelligence on threat actors, including attribution, motivation, capability assessment, and geopolitical context
Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls
Evaluate tools, methodologies, and best practices for understanding adversary TTPs, and proactively share knowledge and techniques with peers
Perform deep network traffic and infrastructure analysis to support both customer requests and independent research, using Team Cymru's unique global dataset
Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets
Identify and refine indicators of compromise (IOCs) and threat actor TTPs, translating these into automated tracking mechanisms where possible to enable ongoing monitoring of threats and adversary groups
Receive, triage, and respond to customer requests with timely, written technical threat intelligence reports tailored to the customer's specific threat landscape and intelligence requirements
Ensure all finished intelligence products meet Team Cymru's analytic standards: clear structure, appropriate use of estimative language and confidence levels, and actionable conclusions
Conduct peer review of colleagues' reporting to maintain consistency, accuracy, objectivity, and analytic rigor across all published products
Work closely with colleagues in the development of analytical tools, data analytics systems, research methodologies, and analysis automation capabilities
Support our threat detection and data acquisition teams to align signature development and telemetry collection with overarching threat intelligence priorities
Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability