Cyber Threat Researcher

Fortinet, Inc.; Burnaby; On-site; CAD 99,000 - 144,000; Full time

Benefits offered by this job

Medical, dental, vision

RRSP with company match

Paid time off

Health Spending Account

EFAP

Parental leave

Job summary

Fortinet, Inc. in Burnaby is seeking a Cyber Threat Researcher to join our network threat research team. You will dive into traffic data, hunt for threats, collect actionable intelligence, and publish high‑impact technical content for the global security community.

You will map adversary techniques to MITRE ATT&CK, design new attack simulations and detection rules, and conduct proactive threat hunting within customer NDR datasets to validate detections.

Qualifications

• 1–3 years hands-on cybersecurity experience in network security, threat intel, or research.
• Strong Linux knowledge and CLI networking/analysis tools.
• Experience with packet capture analysis and Wireshark.
• Experience deploying virtualized labs (VMware/ESXi/Ubuntu).
• Hands-on with Zeek, Suricata, or DPI for network analysis.
• Solid understanding of MITRE ATT&CK and mapping threats to it.
• Excellent writing skills to translate security findings into reports.

Responsibilities

• Collect, correlate, and analyze threat intel to improve detection and response.
• Perform in-depth packet analysis with Wireshark to identify malicious activity.
• Analyze traffic with Zeek, Suricata, and DPI engines.
• Author and edit technical articles for the security community.
• Map findings to the MITRE ATT&CK framework.
• Design attack simulation scenarios and new detection rules.
• Threat hunt within customer NDR datasets to validate detections.

Skills

Linux

Wireshark

Packet capture analysis

MITRE ATT&CK

Threat intelligence

Threat hunting

Technical writing

NDR/SIEM awareness

Python/Bash scripting

Tools

VMware

ESXi

Ubuntu

Zeek

Suricata

DPI

Job description

About the Role

We are looking for a detail-oriented and analytically driven Cyber Threat Researcher to join our network threat research team. In this role, you will dive deep into network traffic, hunt for hidden threats, collect and validate actionable threat intelligence, and produce high-impact technical content. You will track emerging adversary techniques, map them to industry frameworks, and continuously improve our detection capabilities and simulation scenarios.

Key Responsibilities

• Collect, correlate, and analyze threat intelligence sources to extract actionable insights that enhance detection, response, and prevention strategies.
• Perform in-depth network packet analysis using Wireshark to identify malicious activity, protocol anomalies, and attack indicators.
• Analyze network traffic flows and behaviors using Zeek, Suricata, and Deep Packet Inspection (DPI) engines.
• Author and edit technical articles, ensuring clear, accurate, and actionable guidance for the global security community.
• Monitor emerging threats, adversary tactics, and infrastructure trends; map findings to the MITRE ATT&CK framework.
• Design and propose new attack simulation scenarios, detection rules, and research features to proactively counter evolving adversary behaviors.
• Conduct proactive threat hunting within customer NDR (Network Detection and Response) datasets to validate detection efficacy and uncover stealthy threats.

Required Qualifications

• 1–3 years of hands‑on experience in cybersecurity, with a focus on network security, threat intelligence, or security research.
• Strong working knowledge of Linux environments and proficiency with command‑line networking and analysis tools.
• Demonstrated experience with packet capture analysis and frame‑level debugging using Wireshark.
• Practical experience deploying and managing virtualized lab environments (e.g., VMware, ESXi, Ubuntu).
• Hands‑on experience or strong familiarity with Zeek, Suricata, and/or DPI technologies for network traffic analysis.
• Solid understanding of the MITRE ATT&CK framework and experience mapping threats or adversary behaviors to it.
• Excellent technical writing skills with the ability to translate complex security findings into clear, structured, and actionable reports or articles.

Preferred Qualifications (Nice to Have)

• Experience with NDR/SIEM platforms, security telemetry analysis, or automated threat hunting.
• Scripting/automation skills (Python, Bash, PowerShell) for research, detection development, or data processing.
• Relevant cybersecurity certifications are preferred.
• Hands‑on penetration testing expertise across networks, web applications, databases, and OS environments, with strong web security fundamentals and proficiency in tools like Burp Suite, Nessus, SQLmap, and Metasploit/Kali Linux.

The Canada base salary range for this full‑time position is expected to be between $98,500 - $143,700 annually. Wage ranges are based on various factors including the labour market, job type, and job level. Exact salary offers will be determined by factors such as the candidate’s subject knowledge, skill level, qualifications, and experience.

Fortinet strives to provide you and your family with a comprehensive benefits package. Benefits eligibility starts on your first day of hire and comprises of 100% company paid medical, dental, and vision coverage, including a Health Spending Account and a Personal Spending Account that gives you flexibility to spend where you need it the most. Our Employee & Family Assistance Plan (EFAP) offers you and your family access to various services like counseling, legal advice, mental health resources etc. We also provide critical illness, disability, and life insurance, as well as a Group Registered Retirement Savings Plan (RRSP) with a company match to help you save faster for retirement. We offer competitive Paid Time Off and flexible leave policies, including paid health days, to help you take care of yourself and your family members.

All roles are eligible to participate in the Fortinet equity program. Bonus eligibility is reviewed at time of hire and annually at the Company’s discretion.