Black Lotus Labs Threat Researcher - APT Research
About The Position
Black Lotus Labs is seeking a remote Threat Intelligence Researcher to join its Research & Analysis team and focus on tracking advanced threats. The team uses Lumen’s global visibility across a large, interconnected IP backbone, petabyte-scale compute, AI-assisted workflows, proprietary telemetry, and third-party data to conduct threat research, track advanced persistent threat actors, identify emerging criminal infrastructure, and deliver actionable intelligence to customers. This role combines threat intelligence, data science, and security automation. The researcher will build AI-assisted workflows that augment analyst tradecraft, speed threat discovery and detection development, automate enrichment and intelligence production, and turn large-scale telemetry into actionable security insights while preserving analytical rigor, explainability, and operational guardrails. The position is remote, with customer travel in the DC area approximately once per month.
Requirements
- Proven experience in threat analysis and in-depth technical security research, including a track record of identifying and tracking nation-state malicious infrastructure activity, with an emphasis on network traffic analysis.
- Fluency in advanced threat hunting methodologies and attacker tactics, techniques, and procedures (TTPs), with the ability to derive actionable threat hunts, detections, and intelligence requirements from complex datasets.
- Experience with large-scale data analysis platforms and tools such as PySpark.
- Experience with telemetry collection and analysis, including OSINT, proprietary endpoint and network data, DNS and routing data, TTP-based threat hunting, and/or threat hunt tooling that improves cross-organization visibility and supports public-private or multi-company collaboration.
- Proven communication and presentation skills, including the ability to convey complex technical findings, automation-derived insights, and intelligence judgments clearly and concisely to technical, executive, customer, and partner audiences.
Nice To Haves
- Proficiency in malware reverse engineering and incident response.
- Software development experience with Docker, distributed data technologies such as Hadoop or Spark, cloud AI services, vector databases, workflow orchestration, and machine learning frameworks such as TensorFlow or PyTorch.
- Experience with agentic AI or workflow frameworks such as MCP-based architectures.
- Active TS/SCI.
Responsibilities
- Use global datasets, including netflow, malware, and passive DNS, to track malicious cyber actors, infrastructure, and campaigns.
- Build repeatable AI-assisted and automation-driven methods to accelerate detection, prioritization, and intelligence production.
- Apply technical knowledge of adversary capabilities, infrastructure, malware, and network behavior to develop techniques for tracking sophisticated adversaries and delivering actionable threat intelligence to Lumen customers.
- Lead and enhance threat hunting operations in collaboration with research, engineering, data science, and customer-facing teams; build partnerships, explore new data sources, and collaborate on AI-assisted workflows, automation design, and complex analytic problems.
- Identify malicious activity in large-scale network, endpoint, DNS, routing, and enrichment data, and scale detection using Python-based automation and data pipelines.
- Establish AI-powered analytical workflows to automate and scale detection of adversary activity and tradecraft.
- Provide actionable analysis and strategic insights into emerging threats, vulnerabilities, adversary infrastructure, and automation-derived findings; communicate complex technical information clearly to executive leadership, customers, and external stakeholders.
Benefits
- Comprehensive package featuring a broad range of health, life, voluntary lifestyle benefits, and other perks supporting physical, mental, emotional, and financial wellbeing.
- Bonus structure may include short-term incentives, long-term incentives, and/or sales compensation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
