Threat Researcher

Infoblox; Brasil; Remote; BRL 120,000 - 180,000; Full time

Job summary

Infoblox is seeking a Threat Researcher to join the ART team in a home-office setup in Brazil. You will conduct investigations into external cyber threats, including phishing, fraud, leaked credentials, and malicious infrastructure.

You will transform evidence from OSINT, underground sources, internal datasets, and customer data into actionable intelligence. You will collaborate with Threat Intelligence, Engineering, Automation, and product teams to expand coverage, improve workflows, and

Qualifications

• Experience performing cyber threat investigations end-to-end.
• Ability to hunt artifacts across open and dark sources.
• Strong analytical skills to correlate indicators with threats.

Responsibilities

• Conduct end-to-end cyber threat investigations across phishing, fraud, malware, and threat-actor activity.
• Hunt for relevant artifacts across deep web, dark web, and other sources.
• Analyze URLs, domains, IPs, hashes, credentials, files, and ads to identify malicious activity.
• Enrich indicators with OSINT and threat intelligence sources such as VirusTotal, URLScan, WHOIS, and CT logs.

Skills

Threat intelligence

Cybersecurity analysis

OSINT

Malware analysis

Tools

VirusTotal

URLScan

WHOIS

Certificate Transparency

Job description

Job Description

on the Career Hub to view roles side-by-side. At Infoblox, every breakthrough begins with a bold

“what if.”

Job DescriptionPlease review our Career Ladders on the Career Hub to view roles side-by-side.At Infoblox, every breakthrough begins with a bold “what if.” What if your ideas could ignite global innovation? What if your curiosity could redefine the future? We invite you to step into the next exciting chapter of your career journey. Bring your creativity, drive, your daring spirit, and feel what it’s like to thrive on a team big enough to make an impact, yet small enough to make a difference. Our cloud-first networking and security solutions already protect 70% of the Fortune 500, and we’re looking for creative thinkers ready to push that influence even further. Join us and discover how far your bold “what if” can take the world, your community, and your career. How we empower our people is extraordinary: we’re recognized as a Glassdoor Best Place to Work 2025, Great Place to Work-Certified in five countries, and honored by Cigna as a Healthy Workforce honors for three consecutive years; and what we build is world class: named CybersecAsia’s Best in Critical Infrastructure 2024 — clear evidence that when first-class technology meets empowered talent, remarkable careers take shape. So, what if the next big idea, and the next great career story, comes from you? Become the force that turns every “what if” into “what’s next.” In a world where you can be anything, Be Infoblox. Threat Researcher We have an opportunity for a Threat Researcher to join our ART (Axur Research Team) in Home office - Brazil, reporting to the Supervisor, Threat Intelligence. In this role, you will conduct investigations and research into external cyber threats, including phishing, fraud, leaked credentials, malicious infrastructure, and threat-actor activity. You will transform evidence from OSINT, underground sources, internal datasets, and customer-provided information into clear, actionable intelligence. Collaborating closely with Threat Intelligence, Engineering, Automation, Product, and customer-facing teams, you will help expand investigative coverage, improve repeatable workflows, and support AI-assisted research and reporting capabilities. This role is designed for a developing threat researcher who can execute well-defined investigations, strengthen analytical judgment, and contribute to the team’s mission of turning external threat visibility into meaningful protection.

Be a Contributor — What You’ll Do

• Conduct end-to-end cyber threat investigations across phishing, brand abuse, fraud, leaked credentials, malware, and threat-actor activity
• Hunt for relevant artifacts across the deep web, dark web, Telegram channels, underground forums, social platforms, and other authorized sources
• Analyze URLs, domains, IP addresses, hashes, credentials, files, advertisements, and related evidence to identify malicious activity and exposure
• Enrich indicators with OSINT and threat intelligence sources such as VirusTotal, URLScan, WHOIS, passive DNS, Certificate Transparency logs, sandboxes