Senior Threat Intelligence Analyst

Team Cymru•Lake Mary, FL

1d•Remote

About The Position

Team Cymru is seeking a Senior Threat Intelligence Analyst to research and report on threats relevant to customers’ security and intelligence requirements. The analyst will bridge technical and strategic intelligence, producing work for both practitioners and senior leaders that explains threat impact, technical details, and the rationale behind assessments. The role also involves independent threat research and collaboration with engineering teams on analytical tools, data systems, automation, and the broader body of knowledge about threats. The analyst will conduct proactive research into threat actors, malware, campaigns, and tactics, techniques, and procedures (TTPs); analyze network traffic and infrastructure using Team Cymru’s global dataset; respond to customer intelligence requests; and produce clear, rigorous, actionable intelligence. The role includes project leadership, peer review, collaboration with threat detection and data acquisition teams, and representation of Team Cymru in industry and community forums. This is a remote position, with occasional travel within the UK and internationally for customer workshops, industry events, and team meetings.

Requirements

At least 5 years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
Exceptional oral and written communication skills, including the ability to produce customer-facing intelligence reports under time pressure.
Proven track record of leading complex analytical projects or investigations and managing multiple concurrent work streams.
Well-developed analytical, deductive reasoning, and critical thinking skills, including the ability to form assessments from incomplete or ambiguous data.
Ability to work effectively in a distributed, remote team environment, including conducting peer reviews and sharing tradecraft knowledge.
Experience tracking APT, nation-state, or cybercriminal actors and contextualizing their activity within broader geopolitical or strategic circumstances.
Strong network infrastructure and traffic analysis skills, including PCAP, NetFlow, passive DNS, open ports, and certificates.
Deep working knowledge of IP networking and internet services, including DNS, HTTP/HTTPS, TLS, VPNs, and BGP routing protocols.
Knowledge of operating system concepts, indicators of compromise, and their use in host- and network-level detection architectures.
Working proficiency in SQL and in querying and analyzing large, disparate datasets.
Strong familiarity with common OSINT platforms and research techniques.

Nice To Haves

A bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or an equivalent qualification is preferred.
Experience using structured analysis techniques, estimative language, and confidence levels.
Subject matter expertise in a specific region or threat actor group, demonstrated through depth of knowledge of TTPs, infrastructure patterns, and campaign history.
Programming or scripting proficiency, preferably in Python, for data processing, automation, or tool development.
Public speaking skills and experience presenting technical research to large audiences at industry conferences or similar forums.
Familiarity with AI systems for rapidly prototyping analytical tools and developing proof-of-concept projects.
Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data.
Working understanding of malware and network analysis tools and methods, including YARA, Zeek, Suricata, and sandbox reporting.
Exposure to malware reverse engineering, including static and dynamic analysis techniques and tools such as Ghidra, IDA Pro, and x64dbg.
Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including infrastructure provisioning, attribution, and abuse by threat actors.

Responsibilities

Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs.
Investigate and present operational and strategic intelligence, including attribution, motivation, capability assessment, and geopolitical context.
Lead short- and long-term threat tracking projects, identify intelligence gaps, and propose research to address collection shortfalls.
Evaluate tools, methodologies, and best practices for understanding adversary TTPs, and share knowledge with peers.
Analyze network traffic and infrastructure to support customer requests and independent research, using Team Cymru’s global dataset.
Analyze PCAP, NetFlow, passive DNS, open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets.
Identify and refine indicators of compromise and threat actor TTPs, translating them into automated tracking mechanisms where possible.
Triage and respond to customer requests with timely, written technical threat intelligence tailored to customer threat landscapes and intelligence requirements.
Ensure intelligence products meet analytic standards for structure, estimative language, confidence levels, and actionable conclusions.
Peer-review colleagues’ reports to maintain consistency, accuracy, objectivity, and analytic rigor.
Collaborate with colleagues on analytical tools, data analytics systems, research methodologies, and analysis automation.
Support threat detection and data acquisition teams in aligning signature development and telemetry collection with intelligence priorities.
Participate in working groups, industry events, and community collaboration as a representative of Team Cymru’s intelligence capability.
Travel occasionally within the UK and internationally for customer workshops, industry events, and team meetings.