Senior Threat Intelligence Researcher

SentinelOne, Inc.; Madrid; On-site; EUR 90,000 - 120,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Gym reimbursement

Paid time off

Parental leave (16 weeks)

Job summary

SentinelOne, Inc. is seeking a Senior Threat Intelligence Researcher to lead deep-dive investigations into emerging and known threats, synthesizing data into actionable intelligence for senior management.

You will develop refined hunting strategies, track adversary infrastructure, and map threat actor footprints across endpoints, cloud, and networks, leveraging MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP Galaxy. Strong analytical and writing skills are essential.

Qualifications

• Strong analytical skills and ability to identify patterns in large datasets.
• Experience with threat intelligence and threat hunting.
• Familiarity with threat actors, tactics, techniques and procedures (TTPs).
• Proficiency in technical writing and content development.

Responsibilities

• Lead in-depth, hypothesis-driven threat hunts across networks, cloud, and endpoints.
• Synthesize data from internal hunts and external sources into actionable briefings for leadership.
• Develop refined hunting strategies to anticipate shifts in threat actor tradecraft.
• Track adversary infrastructure by pivoting through domain registrations, SSL certs, and DNS.
• Map threat actor footprints using EDR telemetry and TTP analysis.

Skills

Threat intelligence

Threat hunting

Analytical thinking

Technical writing

Tools

YARA

EDR tooling

Sandboxing

Job description

• As a Senior Threat Intelligence Researcher, you will be tasked with leading deep-dive investigations into both emerging and known threats, while maintaining a vigilant watch over malware developments to ensure defenses remain a step ahead of evolving attack methods
• You will synthesize complex data into actionable intelligence and provide senior management with the clear briefings necessary to understand and mitigate potential risks
• You will also develop refined hunting strategies to adapt to and anticipate shifts in threat actor tactics and techniques, and track adversary infrastructure to effectively counteract shifts in threat actor tradecraft through detail-oriented investigation
• Synthesize complex data, from internal hunt findings to intelligence gathered from dark web forums, leak sites, and research repositories, into actionable threat briefings and risk assessments for security leadership and senior stakeholders
• Lead in-depth, hypothesis-driven threat hunts across internal networks, cloud environments, and endpoints to uncover sophisticated intrusions that evade traditional security controls
• Map threat actor footprints internally by pivoting through EDR telemetry
• Analyze adversary tactics, techniques, and procedures (TTPs) within the environment, identifying shifts in execution, persistence, and lateral movement
• Trace adversary infrastructure externally by pivoting through domain registrations, SSL certificates, and passive DNS

Benefits

• Medical, dental, and vision coverage
• Employee assistance program
• Gym reimbursement
• Incentive-based challenges
• Mental health and mindfulness
• Unlimited Time Off
• Grandparent Leave
• Volunteer Time Off
• Paid Sick Time
• Paid Holidays
• 16 weeks Gender-Neutral Parental Leave
• Restricted Stock Unit Program
• Flexible Spending Accounts
• Life Insurance
• Short and Long Term Disability Insurance
• 401K
• Team building activities
• Celebrations and social gatherings
• Community volunteering events
• Global all hands and local town hall events

Knowledge of MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP GalaxyA solid technical understanding of how EDR works is preferredTechnical writing and content development skillsRelevant certifications, such as Certified Malware Analyst (CMA), Certified Reverse Engineering Analyst (CREA), or GIAC Certified Malware Reverse Engineer (GREM), are preferredAn understanding of software vulnerabilities and the ability to implement internal hunting strategies to track their exploitation across the estateKnowledge of the cyber threat landscape, including threat actors and their tactics, techniques, and procedures (TTPs)A background in threat research, threat intelligence or threat huntingStrong analytical skills, with the ability to identify patterns and trends in large datasetsStrong knowledge of YARA to track new malware families, along with knowledge of validation best practicesKnowledge of malware analysis tools and techniques, including static and dynamic analysis, sandboxing, and debuggingKnowledge of how our products operate internally and how to maximize their telemetry