Threat Detection Analyst

Join the mission to make the digital world safer.
About Team Cymru
Team Cymru's mission is to save and improve human lives by helping public and private sector analysts track and take down cybercriminals. We provide visibility into global cyber threat activity and are a key intelligence source for leading cybersecurity and threat intelligence vendors.
Our Pure Signal™ platform gives enterprise security teams on-demand access to global internet traffic telemetry, providing clarity into what's happening across the internet with a level of visibility comparable to their own internal networks. This allows organizations to close detection gaps, accelerate incident response, and get ahead of critical, recurring threats.
Team Cymru is a fast-paced, distribution-focused, private equity-backed company where your work directly supports a mission that protects millions worldwide.
We're looking for a Threat Detection Analyst to serve as the bridge between detection engineering and intelligence research. You'll develop and guide custom detections for the most active network-based threats, while writing for both practitioner and senior leadership audiences. Your work will power our analytical tools, data analytics systems, and analysis automation, and will help our customers complete their security and intelligence missions effectively. This role suits an analyst who has strong analytic tradecraft, is technically proficient, and is energized by the mission-driven, high-signal nature of threat intelligence work.
Key Responsibilities
Detection Engineering
Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups
Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more
Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering
Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers
Conduct quality assurance (QA) reviews on candidate detections developed by teammates
Threat Research
Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs to deepen Team Cymru's body of knowledge
Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls
Perform deep network traffic and infrastructure analysis to support customer requests and independent research, using Team Cymru's unique global dataset
Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets
Produce written products (internal assessments, customer-facing reports, blog articles, presentations) that clearly communicate threat research to practitioner and senior leadership audiences
Collaboration
Work closely with colleagues on the development of tools, data analytics systems, research methodologies, and automated analysis capabilities
Leverage analytic and data expertise to support our Sales and Outreach teams
Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability
Qualifications & Experience
5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst
Experience coding with Python, database technologies (e.g. PostgreSQL, ClickHouse), code collaboration tools (e.g. GitLab, GitHub), and AI-assisted development (Claude Code, Codex, etc.)
Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets
Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams
Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context
Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates
Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP)
Strong familiarity with common OSINT platforms and research techniques
Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft
Exceptional oral and written communication skills
Additional Skills
Experience using structured analysis techniques, estimative language, and confidence levels; comfortable forming assessments from incomplete or ambiguous data
Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data
Working understanding of malware and network analysis: YARA, Zeek, Suricata, sandbox reporting
Familiarity with using AI systems to rapidly prototype analytical tools and proof-of-concept projects
Exposure to malware reverse engineering, including static and dynamic analysis and common tooling (e.g. Binary Ninja, Ghidra, IDA Pro, x64dbg)
Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors
Education and Certifications
Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience (preferred)
Travel
Occasional travel for industry events and customer engagements may be required.
Why Join Team Cymru?
At Team Cymru, we provide unmatched global threat intelligence that empowers organizations to proactively disrupt adversaries. You'll be at the forefront of cybersecurity innovation, helping customers harness the full power of our threat intelligence to achieve critical business and security outcomes.
We offer a collaborative, mission-driven culture where your expertise and impact will directly contribute to improving global security. Our culture is fast-paced, team-oriented, and mission-focused, with ample opportunities to explore, research, and develop new and unique solutions.
We recognize that no candidate will tick every box on this list. If you have strong foundations in threat intelligence and a genuine passion for the work, we encourage you to apply regardless of whether you meet every requirement.
Ready to make an impact? Apply now and join a team protecting millions worldwide.
This job description is not exhaustive. Responsibilities may evolve as needed. Team Cymru is an equal opportunity employer and welcomes applicants from all backgrounds. This is a remote position.

Work arrangement
Yes