Threat Researcher

This is a fully remote position, open to applicants in United States.

📋 Description

• Perform original research on ongoing campaigns, attacker behaviors, and new email and identity attack strategies.

• Define and oversee comprehensive or unclear threat intelligence investigations.

• Utilize Abnormal's platform, internal telemetry, threat intelligence resources, and external research to examine threats.

• Recognize significant patterns, connections, and emerging trends within threat activities.

• Create defensible intelligence assessments and actionable recommendations.

• Integrate complex intelligence from various sources into narratives tailored for specific audiences.

• Transform raw data into insights, implications, recommendations, and coherent narratives.

• Generate threat briefs, analytical reports, customer QBR content, and materials for customer and prospect briefings, webinars, presentations, marketing, and executive summaries.

• Develop rapid-turnaround intelligence products as well as in-depth analytical work.

• Construct reusable narratives, templates, and content frameworks.

• Direct customer and prospect intelligence initiatives, including briefings, webinars, and presentations.

• Address urgent customer inquiries and high-priority pursuits promptly.

• Collaborate with teams in Threat Intelligence, Detection, Sales, Customer Success, and Marketing.

• Mentor P1 and P2 analysts through coaching, peer reviews, and knowledge sharing.

• Provide enablement resources for go-to-market teams.

• Relay customer and field insights back to Threat Intelligence teams.

• Employ AI tools and automation to enhance research, synthesis, drafting, tailoring, and editing while ensuring human review and validation.

⛳️ Requirements

• Minimum of 4 years of experience in threat intelligence, SOC operations, or a closely related cybersecurity field.

• Solid understanding of email and identity attack methods, IOCs, TTPs, attack campaigns, and threat behaviors.

• Proven experience in conducting security research and producing written intelligence or security content for varied audiences.

• Capability to synthesize technical research and data from multiple sources into intelligence assessments, narratives, and recommendations.

• Strong analytical judgment in complex or unclear investigations and the ability to assess incomplete or conflicting evidence.

• Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts.

• Excellent writing skills to communicate complex technical topics clearly and concisely.

• Proficient in presenting complex technical intelligence to customers, executives, security practitioners, or other stakeholders.

• Experience working directly with customers or cross-functional stakeholders, translating technical findings into business relevance.

• Proficiency with AI tools like ChatGPT, Claude, Claude Code, Copilot, or similar platforms.

• Strong project management and prioritization abilities.

• Ability to maintain composure, accuracy, and responsiveness in high-pressure or time-sensitive situations.

• Capability to independently define, prioritize, and execute complex intelligence work from investigation to customer-ready communication.

• Ability to enhance fellow analysts' technical skills through peer reviews, knowledge sharing, coaching, and collaborative problem-solving.

• Demonstrated use of AI tools or automation to scale research, analysis, or content creation.

• Working knowledge of the MITRE ATT&CK framework and common attack techniques, including phishing, BEC, credential harvesting, malware, and account takeover.

• Basic proficiency in SQL, including writing and modifying queries.

• Nice to have: experience in email security, phishing detection, anti-abuse systems, email threat containment, detection engineering, incident response, Abnormal Security or similar platforms, public-facing security content, customer-facing security engagements, training or enablement materials, mentoring analysts, Python or scripting, and security certifications such as Security+, GIAC, CISSP, or CEH.

🏝️ Benefits

• Eligibility for bonus or incentive compensation.

• Equity eligibility.

• Comprehensive benefits package.

• Pre-employment checks conducted in accordance with applicable legislation and company policies.