Threat Intelligence Analyst

Team Cymru•Lake Mary, FL

1d•Remote

About The Position

Team Cymru is seeking a Threat Intelligence Analyst to conduct technical and strategic research that supports customers’ security and intelligence requirements. The analyst will research threat actors, malware, campaigns, and tactics, techniques, and procedures (TTPs); analyze network traffic and infrastructure using Team Cymru’s global dataset; and produce customer-facing intelligence for technical practitioners and senior leaders. The role also contributes to analytical tools, data systems, research methodologies, and automation, and works with internal teams and the broader threat intelligence community. This is a remote position with occasional local and international travel for customer workshops, industry events, and team meetings.

Requirements

At least 5 years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
Exceptional oral and written communication skills, including the ability to produce customer-facing intelligence reports under time pressure.
A proven track record leading complex analytical projects or investigations and managing multiple concurrent work streams.
Well-developed analytical, deductive reasoning, and critical thinking skills, including the ability to form assessments from incomplete or ambiguous data.
Ability to work effectively in a distributed, remote team, conduct peer review, and share tradecraft knowledge.
Experience tracking APT, nation-state, or cybercriminal actors and contextualizing their activity within broader geopolitical or strategic circumstances.
Strong network infrastructure and traffic analysis skills, including PCAP, NetFlow, passive DNS, open ports, and certificates.
Deep working knowledge of IP networking and internet services, including DNS, HTTP/HTTPS, TLS, VPNs, and BGP routing protocols.
Knowledge of operating system concepts, developing and contextualizing indicators of compromise, and their use in host- and network-level detection architectures.
Working proficiency in SQL and querying and analyzing large, disparate datasets.
Strong familiarity with common OSINT platforms and research techniques.

Nice To Haves

A bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent is preferred.
Experience using structured analysis techniques, estimative language, and confidence levels.
Subject matter expertise in a specific region or threat actor group, including demonstrable knowledge of TTPs, infrastructure patterns, and campaign history.
Programming or scripting proficiency, preferably Python, for data processing, automation, or tool development.
Public-speaking skills and experience presenting technical research to large audiences at industry conferences or similar forums.
Familiarity with using AI systems to rapidly prototype analytical tools and develop proof-of-concept projects.
Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data.
Working understanding of malware and network analysis, including YARA, Zeek, Suricata, and sandbox reporting.
Exposure to malware reverse engineering, including static and dynamic analysis techniques and common tools such as Ghidra, IDA Pro, and x64dbg.
Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including infrastructure provisioning, attribution, and abuse by threat actors.

Responsibilities

Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs.
Investigate and present operational and strategic intelligence, including attribution, motivation, capability assessments, and geopolitical context.
Lead short- and long-term threat-tracking projects, identify intelligence gaps, and propose research to address collection shortfalls.
Evaluate and share tools, methodologies, and best practices for understanding adversary TTPs.
Analyze network traffic and infrastructure using datasets such as PCAP, NetFlow, passive DNS, open ports, and certificates.
Map malicious infrastructure, identify related threat-actor assets, and refine indicators of compromise and TTPs, translating them into automated tracking where possible.
Triage and respond to customer requests with timely technical intelligence reports tailored to customer requirements and threat landscapes.
Ensure finished intelligence products meet analytic standards, including clear structure, estimative language, confidence levels, and actionable conclusions.
Peer-review colleagues’ reports for consistency, accuracy, objectivity, and analytic rigor.
Collaborate on analytical tools, data analytics systems, research methodologies, and analysis automation.
Support threat detection and data acquisition teams in aligning signature development and telemetry collection with intelligence priorities.
Represent Team Cymru’s intelligence capability in working groups, industry events, and community collaboration.