Staff Threat Intelligence Researcher

Accountabilities: Lead rapid-response investigations into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity. Proactively hunt across internal managed detection and response (MDR) and incident response (IR) telemetry to uncover active campaigns, unknown infrastructure, malware, intrusion patterns, and recurring adversary behaviors. Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source intelligence to develop and validate investigation hypotheses. Determine the scope and potential impact of widespread activity, including affected customers, observed behaviors, intrusion timelines, infrastructure connections, and confidence in campaign or actor assessments. Produce timely intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings during significant security events. Develop and operationalize YARA and Sigma rules, behavioral analytics, search logic, indicators, and detection hypotheses in collaboration with detection engineering and security operations teams. Support active investigations by providing adversary context, collection requirements, analytical judgments, and follow-up hunting recommendations. Establish consistent standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation. Build reusable research methods, tools, automation, and investigation playbooks that accelerate the process from initial threat signals to validated findings and customer protection. Publish high-quality internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums. Mentor other researchers and strengthen investigative practices through original research and repeatable adversary analysis techniques. Requirements: Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a closely related discipline, with demonstrated technical leadership as a senior individual contributor. Deep understanding of nation-state and cybercriminal activity, ransomware operations, initial-access techniques, malware ecosystems, and vulnerability exploitation. Proven experience investigating large-scale endpoint, network, cloud, identity, email, and security operations telemetry using SIEM, EDR, data lake, or comparable analysis platforms. Strong analytical and scripting skills, including experience with SQL, Python, Kusto Query Language (KQL), SPL, or similar languages for large-scale data analysis, enrichment, and workflow automation. Hands-on experience analyzing host and network telemetry, such as process execution, command-line activity, authentication events, DNS, proxy and firewall logs, Zeek, Sysmon, auditd, and cloud audit records. Ability to translate intelligence findings into YARA and Sigma rules, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements. Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence. Familiarity with malware analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities. Strong technical writing and communication skills, with the ability to produce publication-quality research and explain findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences. Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or rapidly evolving security incidents. Commitment to security, privacy, and compliance requirements, including the protection of confidential business, customer, and employee information. Candidates participating in remote video interviews are expected to keep their cameras on. If technical, bandwidth, or location-related circumstances prevent this, advance notice is required so appropriate accommodations can be discussed. Benefits: Annual base salary range of $86,000–$240,000 USD, depending on skills, experience, location, and job-family level. Variable incentive compensation. New-hire equity grants and employee equity participation. Flexible time off and paid volunteer days. 401(k) contributions and matching. Comprehensive benefits, including medical, mental health, dental, disability, life, and accidental death and dismemberment (AD&D) coverage, along with additional services. Employee Assistance Program (EAP), including mental health support. Fertility support and paid parental leave. Training and career development programs. Employment may be subject to background verification and additional security, regulatory, compliance, or export-control requirements, where applicable.