Senior Threat Intelligence Analyst (Rest of World APT ...

OverviewSenior Threat Intelligence Analyst (Rest of World APT Focus) — Join Recorded Future as part of Insikt Group’s Strategic and Persistent Threats (SPT) team to track state-sponsored APT campaigns, mentor peers, and support Analyst-on-Demand services. Focus is on state-sponsored cyber threats originating outside the traditional Big Four with emphasis on regions such as Asia, Europe, the Middle East, and emerging strategic areas.What You’ll DoConduct proactive research on state-sponsored APT activity by synthesizing multiple technical datasets to develop novel insights and high-quality reportingEstablish and refine methods to track APT campaigns using network, intrusion, and malware analysisHunt for threat actor infrastructure and activity across diverse technical data sources, leveraging banner data, service metadata, and related technical artifactsIdentify, prioritize, and deploy detection mechanisms for command-and-control infrastructure, malware families, and threat groups of interestContinuously evaluate and improve threat intelligence workflows, identifying opportunities to enhance automation, efficiency, and analytic precisionStay up to date on evolving APT tradecraft by regularly reviewing technical publications, blogs, and intelligence from trusted sharing communitiesMentor colleagues on intrusion analysis tradecraft and threat intelligence best practices, fostering a culture of knowledge sharing and continuous developmentCollaborate with geopolitical and regional analysis teams to support cross-functional researchPropose and evaluate new data sources and analytical methods to enhance or automate the intelligence cycleRepresent Insikt Group externally as a subject matter expert through customer briefings, media engagements, or public research disseminationCollaborate with engineering and data science teams to ensure effective integration of relevant data and analytics into the Recorded Future platformSupport customer intelligence needs through Recorded Future’s Analyst-on-Demand serviceWhat You’ll Bring (Required)BA/BS or equivalent experience in Computer Science, Computer Engineering, Information Security, Security Studies, Intelligence, or a related fieldPreferably 5+ years of experience in Information Security and/or Threat IntelligenceDemonstrated experience conducting technical threat analysis and researchIn-depth knowledge of TCP/IP and other networking protocols and datasets relevant to intrusion and network infrastructure analysisDemonstrated capability in identifying and tracking infrastructure through methods such as banner analysis and metadata correlationExperience with static and dynamic malware analysis, including family attribution and variant clusteringProficiency in scripting (Python preferred, or Go, C, C++, Java) and fluency with common CTI research tools such as Maltego, Jupyter Notebook, the Elastic Stack, and similar toolsProven experience applying structured analytical techniques and intelligence methodologies to assess state-sponsored threat activity, including the intelligence cycle, intelligence writing best practices, and frameworks such as the Diamond ModelFamiliarity with threat modeling and adversary tracking frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and related models to support campaign clustering, detection development, and strategic reportingDetailed understanding of existing APT groups’ past activities, TTPs, motivations, and targeting patternsExperience with open-source intelligence-gathering tools and techniquesExperience working directly with customers, with strong written and verbal communication skills to clearly convey complex technical and non-technical conceptsStrong interpersonal and teamwork skills, including working with globally distributed team membersPreferred QualificationsMA/MS or equivalent experience in Computer Science, Computer Engineering, Information Security, or a related fieldExperience writing network and endpoint detection signaturesExperience with Windows, iOS, Android, macOS, or malware analysisProficiency in a high-priority foreign language, with preference for Arabic, Chinese, Farsi, Korean, Portuguese, Russian, or SpanishThe base salary range for this full-time position is $127,000 - $160,000. Our salary ranges are determined by role, level, and location. The range displayed reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by state, work location and additional factors, including job-related skills, experience, and relevant education or training. This position may be eligible for incentive compensation, equity, and medical, dental, vision, life insurance and 401K. Your recruiter can share more about the specific details of the compensation and benefit package during the hiring process.Why should you join Recorded Future? Recorded Future employees (or Futurists) represent diverse nationalities and embody our core values of high standards, inclusion, and ethics. Our dedication to empowering clients with intelligence to disrupt adversaries has earned a 4.8-star Gartner rating and a large client base including many Fortune 100 companies.We are committed to maintaining an environment that attracts and retains talent from a diverse range of experiences, backgrounds and lifestyles. If you need accommodation or special assistance, please contact our recruiting team at levelMid-Senior levelEmployment typeFull-timeJob functionInformation TechnologyIndustriesComputer and Network Security and Software Development #J-18808-Ljbffr

Created: 2025-09-21