Senior Threat Intelligence Analyst - Operational Outcomes (Threat Hunting)

This Role: As a senior technical threat researcher for our Insikt (Research) Group, you’ll work alongside our highly skilled team members and provide assistance researching cybercriminal and APT activities. Day-to-day responsibilities will include research leads-generation, analysis of malicious tools, infrastructure profiling, and writing high-quality intelligence assessments.

The Insikt Group ® is Recorded Future’s elite research division. The division takes its name from the Swedish “Insikt” meaning Insights, which references our company’s roots in Sweden. Insikt’s mission is to produce intelligence on a range of cyber and geopolitical threats to reduce risk for clients. The team is composed of analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience who work tirelessly to help secure the world with intelligence.

What you’ll do as a Senior Threat Intelligence Analyst:

• Develop tools and methods to identify both commodity and custom malware using retro hunting and advanced detection techniques in common malware multi-scanner repositories as well as within Recorded Future's exclusive collection
• Support other threat intelligence analysts to analyze malware associated with advanced threat actors to develop leads and insights into actor infrastructure, tooling, and targeting
• Stay on top of developments within the malware landscape and track key developments by following publications, blogs, and mailing lists
• Perform network analysis of malicious infrastructure
• Develop network and host-based detection rules such as SNORT and YARA to detect APT or cybercriminal campaigns in line with Insikt research goals.
• Publish research on novel threats and research results
• Internal tools development 

What you’ll bring to the Senior Threat Intelligence Analyst (required):

• BA/BS or MA/MS degree or equivalent experience in Computer Science, Information Security, Computer Engineering, or a related field
• 7+ years of experience doing technical cybersecurity research experience, including malware analysis, network analysis, threat hunting, or similar
• Experience writing network and endpoint signature detections
• Demonstrable experience of conducting cyber threat investigations 
• Programming experience in C, C++, C#, Python, Go, Powershell, or Bash 
• Practical experience using common threat intelligence analysis models such as MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain
• Excellent written and verbal communication skills, ability to convey complex technical and non-technical concepts

Additional Skills/Experience (preferred but not required):

• 7+ years of experience with static and dynamic malware analysis on Windows binaries, using tools such as Ghidra, IDA Pro, x64dbg, OllyDbg and Wireshark
• 7+ years of experience in network analysis tools
• Knowledge of Windows operating system internals and the Windows API 
• Experience in analyzing both desktop and mobile malware 
• Experience in the deobfuscation of malware, analysis of packers, malware decryption techniques
• Experience working and communicating directly with clients
• Multiple languages are a plus