Threat Intelligence Analyst

Team Cymru•Lake Mary, FL

8d•Remote

About The Position

Team Cymru is seeking a Threat Intelligence Analyst to research, analyze, and report on threats affecting customers, while contributing to the company’s broader threat intelligence knowledge and analytical capabilities. The role bridges technical and strategic intelligence, producing work for both practitioner and senior leadership audiences that explains threat impacts, technical details, and the rationale behind assessments. The analyst will conduct proactive research into threat actors, malware, campaigns, and tactics, techniques, and procedures (TTPs); perform network and infrastructure analysis using Team Cymru’s global dataset; and deliver timely, actionable customer-facing intelligence. The position also involves leading threat-tracking projects, identifying intelligence gaps, reviewing colleagues’ reports, and collaborating with engineering, threat detection, data acquisition, and external intelligence communities. This is a remote position. Occasional local and international travel for customer workshops, industry events, and team meetings is required.

Requirements

At least 5 years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
Exceptional oral and written communication skills, including the ability to produce customer-facing intelligence reports under time pressure.
Proven track record of leading complex analytical projects or investigations and managing multiple concurrent work streams.
Well-developed analytical, deductive reasoning, and critical thinking skills, with comfort forming assessments from incomplete or ambiguous data.
Ability to work effectively in a distributed, remote team environment, including conducting peer reviews and sharing tradecraft knowledge.
Experience tracking APT, nation-state, or cybercriminal actors and contextualizing their activity within broader geopolitical or strategic landscapes.
Strong network infrastructure and traffic analysis skills, including PCAP, NetFlow, PDNS, open ports, and certificates.
Deep working knowledge of IP networking and internet services, including DNS, HTTP/HTTPS, TLS, VPNs, and BGP routing protocols.
Knowledge of operating system concepts, developing and contextualizing IOCs, and understanding their deployment in host- and network-level detection architectures.
Working proficiency in SQL and querying and analyzing large, disparate datasets.
Strong familiarity with common OSINT platforms and research techniques.

Nice To Haves

Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent.
Experience using structured analysis techniques, estimative language, and confidence levels.
Subject matter expertise for a specific region or threat actor group, with demonstrable depth in TTPs, infrastructure patterns, and campaign history.
Programming or scripting proficiency, preferably Python, for data processing, automation, or tool development.
Public speaking experience presenting technical research to large audiences at industry conferences or similar forums.
Familiarity with using AI systems to rapidly prototype analytical tools and develop proof-of-concept projects.
Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data.
Working understanding of malware and network analysis tools and methods, including YARA, Zeek, Suricata, and sandbox reporting.
Exposure to malware reverse engineering, including static and dynamic analysis techniques and tools such as Ghidra, IDA Pro, and x64dbg.
Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors.

Responsibilities

Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs.
Investigate and present operational and strategic intelligence on threat actors, including attribution, motivation, capability assessment, and geopolitical context.
Lead short- and long-term threat-tracking projects, identify intelligence gaps, and propose research to address collection shortfalls.
Evaluate tools, methodologies, and best practices for understanding adversary TTPs, and share knowledge and techniques with peers.
Perform network traffic and infrastructure analysis for customer requests and independent research using Team Cymru’s global dataset.
Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets.
Identify and refine indicators of compromise (IOCs) and threat actor TTPs, translating them into automated tracking mechanisms where possible.
Triage and respond to customer requests with timely written technical threat intelligence reports tailored to customer threat landscapes and intelligence requirements.
Ensure finished intelligence products meet Team Cymru’s analytic standards, including clear structure, appropriate estimative language and confidence levels, and actionable conclusions.
Conduct peer reviews of colleagues’ reporting to maintain consistency, accuracy, objectivity, and analytic rigor.
Collaborate with colleagues on analytical tools, data analytics systems, research methodologies, and analysis automation.
Support threat detection and data acquisition teams in aligning signature development and telemetry collection with threat intelligence priorities.
Represent Team Cymru’s intelligence capability in working groups, industry events, and community collaboration.