Threat Detection Analyst

🔥 7 minutes ago

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🧐 Analyst

👻 Ghost score 12%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Team Cymru

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 1998

💼 Consulting

🏥 Healthcare

🔒 Cybersecurity

💰 Private equity on 2021-09

Consulting • Healthcare • Cybersecurity

Team Cymru is a cybersecurity company that delivers real-time, internet-scale threat intelligence and network visibility to defenders of critical infrastructure. They analyze raw NetFlow and global internet activity to provide passive asset discovery, actionable threat feeds, botnet and malware analysis, DDoS mitigation, and incident-response support (CSIRT). Their products integrate with SIEM, SOAR, and TIP platforms and are offered as feeds, APIs, and managed services to enterprise and security operations teams.

📋 Description

• Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups • Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more • Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering • Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers • Conduct quality assurance reviews on candidate detections developed by teammates • Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs • Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research • Perform deep network traffic and infrastructure analysis to support customer requests and independent research • Analyze PCAP, NetFlow, passive DNS, open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets • Produce internal assessments, customer-facing reports, blog articles, and presentations for practitioner and senior leadership audiences • Collaborate on tools, data analytics systems, research methodologies, and automated analysis capabilities • Support Sales and Outreach teams with analytic and data expertise • Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability

🎯 Requirements

• 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst • Experience coding with Python, database technologies (e.g. PostgreSQL, ClickHouse), code collaboration tools (e.g. GitLab, GitHub), and AI-assisted development (Claude Code, Codex, etc.) • Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets • Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams • Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context • Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates • Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP) • Strong familiarity with common OSINT platforms and research techniques • Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft • Exceptional oral and written communication skills • Experience using structured analysis techniques, estimative language, and confidence levels • Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data • Working understanding of malware and network analysis: YARA, Zeek, Suricata, sandbox reporting • Familiarity with using AI systems to rapidly prototype analytical tools and proof-of-concept projects • Exposure to malware reverse engineering, including static and dynamic analysis and common tooling (e.g. Binary Ninja, Ghidra, IDA Pro, x64dbg) • Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors • Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience (preferred) • Occasional travel for industry events and customer engagements may be required

🏖️ Benefits

• Collaborative, mission-driven culture • Remote position • Opportunities to explore, research, and develop new and unique solutions • Occasional travel for industry events and customer engagements

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume