Black Lotus Labs Threat Researcher - APT Research

Lumen Technologies • Remote, OR

1d • $129,639 - $190,137 • Remote

About The Position

Lumen’s Black Lotus Labs is seeking a remote Threat Intelligence Researcher for its Research & Analysis team, focused on tracking advanced threats. The team uses Lumen’s global visibility across its IP backbone, petabyte-scale compute, AI-assisted workflows, proprietary telemetry, and third-party data to conduct threat research, hunt and track advanced persistent threat actors, identify emerging criminal infrastructure, and turn large-scale observations into actionable intelligence for customers.

The role combines threat intelligence, data science, and security automation. The researcher will help develop AI-assisted workflows that augment analyst tradecraft, accelerate threat discovery and detection development, automate enrichment and intelligence production, and transform large-scale telemetry into security insights while maintaining analytical rigor, explainability, and operational guardrails. The position is remote, with customer travel in the DC area approximately once per month.

Requirements

• Proven experience in threat analysis and in-depth technical security research, including identifying and tracking nation-state malicious infrastructure activity with an emphasis on network traffic analysis.
• Fluency in advanced threat-hunting methodologies and attacker tactics, techniques, and procedures (TTPs), with the ability to derive actionable threat hunts, detections, and intelligence requirements from complex data sets.
• Experience with large-scale data analysis platforms and tools such as PySpark.
• Experience collecting and analyzing telemetry, including OSINT, proprietary endpoint and network data, DNS and routing data, TTP-based threat hunting, and/or threat-hunt tooling that improves cross-organization visibility and supports public-private or multi-company collaboration.
• Strong communication and presentation skills, including the ability to explain complex technical findings, automation-derived insights, and intelligence judgments to technical, executive, customer, and partner audiences.

Nice To Haves

• Proficiency in malware reverse engineering and incident response.
• Software development experience with Docker, distributed data technologies such as Hadoop or Spark, cloud AI services, vector databases, workflow orchestration, and machine learning frameworks such as TensorFlow or PyTorch.
• Experience with agentic AI or workflow frameworks such as MCP-based architectures.
• Active TS/SCI clearance.

Responsibilities

• Set direction for systems, networks, user services, and vendor development efforts.
• Assess advances in technical security technologies and test solutions to validate their features and functions.
• Collaborate with others to resolve interoperability issues and successfully integrate security solutions across platforms.
• Implement technical security solutions using expertise gained from multiple and complex client environments.
• Conduct threat research and hunt and track advanced persistent threat actors and emerging criminal infrastructure.
• Develop AI-assisted workflows to augment analyst tradecraft, accelerate threat discovery and detection development, automate enrichment and intelligence production, and turn large-scale telemetry into actionable insights.

Benefits

• Comprehensive package featuring health, life, and voluntary lifestyle benefits.
• Perks intended to support physical, mental, emotional, and financial wellbeing.
• Bonus structure may include short-term incentives, long-term incentives, and/or sales compensation.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed