[Hiring] Threat Detection Analyst @Team Cymru

Role Description

Join the mission to make the digital world safer. We're looking for a Threat Detection Analyst to serve as the bridge between detection engineering and intelligence research. You'll develop and guide custom detections for the most active network-based threats, while writing for both practitioner and senior leadership audiences. Your work will power our analytical tools, data analytics systems, and analysis automation, and will help our customers complete their security and intelligence missions effectively. This role suits an analyst who has strong analytic tradecraft, is technically proficient, and is energized by the mission-driven, high-signal nature of threat intelligence work.

Key Responsibilities

• Detection Engineering
  • Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups.
  • Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more.
  • Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering.
  • Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers.
  • Conduct quality assurance (QA) reviews on candidate detections developed by teammates.
• Threat Research
  • Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs to deepen Team Cymru's body of knowledge.
  • Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls.
  • Perform deep network traffic and infrastructure analysis to support customer requests and independent research, using Team Cymru's unique global dataset.
  • Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets.
  • Produce written products (internal assessments, customer-facing reports, blog articles, presentations) that clearly communicate threat research to practitioner and senior leadership audiences.
• Collaboration
  • Work closely with colleagues on the development of tools, data analytics systems, research methodologies, and automated analysis capabilities.
  • Leverage analytic and data expertise to support our Sales and Outreach teams.
  • Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability.

Qualifications

• 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
• Experience coding with Python, database technologies (e.g. PostgreSQL, ClickHouse), code collaboration tools (e.g. GitLab, GitHub), and AI-assisted development (Claude Code, Codex, etc.).
• Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets.
• Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams.
• Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context.
• Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates.
• Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP).
• Strong familiarity with common OSINT platforms and research techniques.
• Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft.
• Exceptional oral and written communication skills.

Additional Skills

• Experience using structured analysis techniques, estimative language, and confidence levels; comfortable forming assessments from incomplete or ambiguous data.
• Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data.
• Working understanding of malware and network analysis: YARA, Zeek, Suricata, sandbox reporting.
• Familiarity with using AI systems to rapidly prototype analytical tools and proof-of-concept projects.
• Exposure to malware reverse engineering, including static and dynamic analysis and common tooling (e.g. Binary Ninja, Ghidra, IDA Pro, x64dbg).
• Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors.

Education and Certifications

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience (preferred).

Travel

• Occasional travel for industry events and customer engagements may be required.

Benefits

• At Team Cymru, we provide unmatched global threat intelligence that empowers organizations to proactively disrupt adversaries.
• Collaborative, mission-driven culture where your expertise and impact will directly contribute to improving global security.
• Fast-paced, team-oriented, and mission-focused environment with ample opportunities to explore, research, and develop new and unique solutions.
• We recognize that no candidate will tick every box on this list. If you have strong foundations in threat intelligence and a genuine passion for the work, we encourage you to apply regardless of whether you meet every requirement.

Ready to make an impact? Apply now and join a team protecting millions worldwide. This job description is not exhaustive. Responsibilities may evolve as needed. Team Cymru is an equal opportunity employer and welcomes applicants from all backgrounds. This is a remote position.