Senior Threat Intelligence Analyst

Team Cymru • Lake Mary, FL

1d • Remote

About The Position

Team Cymru is hiring a Senior Threat Intelligence Analyst to conduct technical and strategic threat intelligence research and reporting for customers and internal teams. The analyst will investigate threat actors, malware, campaigns, and evolving tactics, techniques, and procedures (TTPs); analyze network traffic and internet infrastructure using Team Cymru’s global dataset; and produce clear, actionable intelligence for both technical practitioners and senior leaders. The role also contributes to analytical tools, data analytics systems, research methodologies, and automation, and represents Team Cymru in industry collaboration. The position is remote and requires occasional travel within the UK and internationally for customer workshops, industry events, and team meetings.

Requirements

• At least 5 years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
• Exceptional oral and written communication skills, including the ability to produce customer-facing intelligence reports under time pressure.
• A proven track record of leading complex analytical projects or investigations and managing multiple concurrent work streams.
• Well-developed analytical, deductive reasoning, and critical thinking skills, including the ability to form assessments from incomplete or ambiguous data.
• Ability to work effectively in a distributed, remote team, conduct peer reviews, and share tradecraft knowledge.
• Experience tracking APT, nation-state, or cybercriminal actors and contextualizing their activity within a broader geopolitical or strategic landscape.
• Strong network infrastructure and traffic analysis skills, including PCAP, NetFlow, passive DNS, open ports, and certificates.
• Deep working knowledge of IP networking and internet services, including DNS, HTTP/HTTPS, TLS, VPNs, and BGP routing protocols.
• Knowledge of operating system concepts, indicators of compromise, and their deployment in host- and network-level detection architectures.
• Working proficiency in SQL and querying and analyzing large, disparate datasets.
• Strong familiarity with common OSINT platforms and research techniques.

Nice To Haves

• Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent.
• Experience using structured analysis techniques, estimative language, and confidence levels.
• Subject matter expertise in a specific region or threat actor group, with demonstrable depth in TTPs, infrastructure patterns, and campaign history.
• Programming or scripting proficiency, preferably Python, for data processing, automation, or tool development.
• Public-speaking experience presenting technical research to large audiences at industry conferences or similar forums.
• Familiarity with using AI systems to rapidly prototype analytical tools and develop proof-of-concept projects.
• Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data.
• Working understanding of malware and network analysis tools and methods, including YARA, Zeek, Suricata, and sandbox reporting.
• Exposure to malware reverse engineering, including static and dynamic analysis techniques and tools such as Ghidra, IDA Pro, and x64dbg.
• Familiarity with hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors.

Responsibilities

• Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs.
• Investigate and present operational and strategic intelligence, including attribution, motivation, capability assessment, and geopolitical context.
• Lead short- and long-term threat-tracking projects, identify intelligence gaps, and propose research to address collection shortfalls.
• Evaluate tools, methodologies, and best practices for understanding adversary TTPs, and share knowledge with peers.
• Perform network traffic and infrastructure analysis for customer requests and independent research using Team Cymru’s global dataset.
• Analyze PCAP, NetFlow, passive DNS, open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets.
• Identify and refine indicators of compromise and threat actor TTPs, translating them into automated tracking mechanisms where possible.
• Triage and respond to customer requests with timely written technical threat intelligence reports tailored to customer requirements.
• Ensure intelligence products meet analytic standards for structure, estimative language, confidence levels, and actionable conclusions.
• Peer-review colleagues’ reports for consistency, accuracy, objectivity, and analytic rigor.
• Collaborate on analytical tools, data analytics systems, research methodologies, and analysis automation.
• Support threat detection and data acquisition teams in aligning signature development and telemetry collection with intelligence priorities.
• Participate in working groups, industry events, and community collaboration as a representative of Team Cymru’s intelligence capability.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed