Senior Threat Intelligence Reseacher

Salesforce•McLean, VA

4d•$148,500 - $223,900•Remote

About The Position

As a Senior Threat Intelligence Researcher (Production), you don't just track threats—you contextualize and produce organic intelligence about them. You are a key pillar of the Threat Intelligence (TI) team, specifically focused on intelligence production across our suite of products and threat actors we track. You will lead the charge in translating nuanced technical intelligence and actor tracking operations into synthesized intelligence products for a wide and diverse audience. Your work will directly support other aspects of TI’s threat actor tracking and disruption work, informing the business to take action that imposes friction on threat actors targeting the Salesforce ecosystem. This is a role where you need to have a baseline technical capability and proven intelligence analysis skills—you are already well-versed at producing various intelligence products in written form and you have proven expertise in briefing to multiple audiences, running from technical to executive. You will analyze new and emerging threats to Salesforce, our platforms, and our customers, and turn that intelligence into action. Crucial to this work is directly engaging TI customers across key phases of the Threat Intelligence Lifecycle—shaping planning & direction, executing dissemination, and soliciting feedback to continuously refine intelligence output. You also understand the value of Community engagement and will participate in not just disseminating intelligence internally but also sharing the nuance of our work within the broader Threat Community. This candidate must be a U.S. citizen (U.S. born or naturalized) operating on U.S. Soil who does not hold dual citizenship with the ability to meet customer and government screening standards applicable to this role.

Requirements

At least 5 years of professional experience identifying patterns and trends across various data sources to distill findings concisely for various audiences at scale.
3+ years experience with Cyber Threat Intelligence writing for both technical, non-technical, and executive audiences - ideally with threat briefings, threat reports, blog posts, or similar finished intelligence.
3+ years experience conducting and correlating threat research using OSINT, paid-for threat vendors, incident response engagement data, and proprietary tools.
A capable oral and written communicator, you are able to engage others in the business at multiple levels to translate threat research into actionable recommendations to shape the business.
Experience identifying, tracking of advanced cyber threat actors, including government-backed and advanced e-crime adversaries; knowledge of advanced actor TTPs and how to translate these to various audiences.
Established threat intelligence practitioner (active engagement in the Information Security or Threat Community with contacts is a big plus).
Experience using various AI tools for large data set analysis and intelligence support.
You operate in a semi-autonomous to autonomous manner, driving the delivery of projects and deliverables with minimal oversight across multiple teams.
You can work actively as a part of a globally distributed team, including remote and in-person colleagues.
This candidate must be a U.S. citizen (U.S. born or naturalized) operating on U.S. Soil who does not hold dual citizenship with the ability to meet customer and government screening standards applicable to this role.
This candidate must be a U.S. citizen (U.S. born or naturalized) who does not hold dual citizenship and agrees to complete a U.S. federal government Minimum Background Investigation (MBI) for a Moderate Public Trust position.

Nice To Haves

5 years hands-on experience with strategic intelligence writing and standard conventions (BLUF, Diamond Model, MITRE ATT&CK), with a proven track record of authoring dozens of research articles and public-facing blog posts.
Capability to learn or experience with security analysis tools (Jupyter notebooks, Splunk, ElasticSearch, etc.).
Experience with SOAR platforms.
Experience with various AI tools.
Experience with threats in AWS, Microsoft Azure, and Google Cloud.
Experience or an understanding of hunting/IR tools used for host and network analysis.
Experience using Threat Intelligence Platforms; building integrations with these platforms is a plus.
You have an understanding of existing and emerging threats to an organization spanning multiple industries and threat profiles; any threat hunting experience is a big plus.
Active member of private, invite-only Information Security trust groups with extensive industry and community contacts.
You have performed all of the above “at scale“ in a large, complex environment

Responsibilities

Lead technical pipeline development of capabilities focused on creation and delivery of intelligence products.
Maintain and enhance Salesforce TI’s threat prioritization model to continually identify top threats to Salesforce.
Coordinate and manage creation, organization, development, and delivery of threat intelligence quarterly briefings to senior security and company leadership.
Serve as one of the primary team interfaces with threat intelligence customers, managing educational presentations and incorporating feedback into threat intelligence capability development.
Lead the development of routine and ad hoc threat intelligence written products, and own the customer dissemination portfolio for the team.
Consume and curate threat data to create intelligence assessments in support of our incident response, threat hunting, threat detection, security engineering, and risk prioritization missions.
Consume and curate OSINT and paid-for vendor reporting to contextualize the threat landscape.
Write scripts (or capability to learn how to) and tools to help with analysis and build automation to aid investigations and threat research using lessons learned.
Build expertise on any threats targeting Salesforce and provide attribution to attacker activity when possible
Identify new and existing threats and clearly distill this information to support finished intelligence to multiple internal partners, including executives.
Perform intelligence research during incident response, supporting multiple teams and drive direction of investigations based on knowledge of attackers.