Cyber Threat Intelligence Analyst

Nebius Group; United States; On-site; USD 90,000 - 150,000; Full time

Benefits offered by this job

Competitive compensation

Career growth

Flexibility and ownership

Collaborative culture

Impactful AI projects

International environment

Job summary

Nebius is seeking a Cyber Threat Intelligence Analyst to collect, analyze, and document cyber threats affecting Nebius AI/cloud infrastructure. You will support security investigations, threat hunting, and intelligence hygiene while collaborating with SOC teams.

The role requires strong OSINT skills, experience with threat intelligence platforms, and a solid understanding of MITRE ATT&CK and TTP mapping. Remote-ready candidates in the US are welcome to apply.

Qualifications

• CTI methodology and the intelligence cycle understanding.
• Hands-on familiarity with OSINT tools (Shodan, Censys, crt.sh, VirusTotal).
• Experience with intelligence systems/platforms and handling an alert stream (triage).
• Understanding of MITRE ATT&CK framework and TTP mapping.
• Ability to support incident investigations and hunt missions, working closely with the SOC in real time.
• Analytical capabilities of logical reasoning, critical thinking, and problem-solving.
• Concise technical writing ability (BLUF, structured reports).
• Understanding of cloud infrastructure attack techniques is beneficial.

Responsibilities

• Collection: Run OSINT searches across Nebius priorities and sources.
• Intelligence Systems & Feeds: Receive alerts, query systems, and validate findings.
• Feed Consolidation: Aggregate feeds into a unified, actionable picture.
• Analysis: Map TTPs to MITRE ATT&CK and identify impersonation.
• Threat Impact Assessment: Assess likelihood and operational impact.
• Incident Investigation: Support SOC by enriching IOCs and providing context.
• Threat Hunting Support: Augment detection through intel-driven hunts.
• Threat Actor Tracking: Document activity and campaigns of relevant groups.
• IOC Management: Collect, validate, defang, and prioritize indicators.
• Watchlist Maintenance: Update search terms and monitored domains.
• Documentation & Reporting: Write findings with BLUF and confidence levels.
• Intelligence Hygiene: Log false positives and classify information clearly.

Skills

CTI methodology

OSINT tools

Intelligence platforms

MITRE ATT&CK

Incident response support

Threat hunting

Analytical thinking

Technical writing

Tools

Shodan

Censys

crt.sh

VirusTotal

URLScan

Job description

About Nebius:

Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure.

Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI.

Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.

The role

As a Cyber Threat Intelligence(CTI) Analyst you will collect, analyze, and document cyber threat intelligence relevant to Nebius, its AI/Cloud infrastructure, employees, products, and brand, support security incident investigations, and provide verified, timely, and actionable findings that enable early detection of and response to emerging threats. Your intelligence activities will be driven by Nebius Priority Intelligence Requirements and continuously adapted to the evolving threat landscape.

Your responsibilities will include:

• Collection: Run systematic searches based on Nebius Priority Intelligence Requirements across OSINT sources (Shodan/Censys, crt.sh, GitHub, VirusTotal/URLscan, Google dorks), commercial threat intelligence platforms, and Dark Web / Telegram monitoring.
• Intelligence Systems & Feeds: Receive and process alerts from the intelligence platforms the company is connected to, proactively query those systems (queries, pivoting), and cross-reference and validate findings against additional intelligence sources to reduce false positives, enrich alerts, and assess relevance to Nebius.
• Feed Consolidation: Aggregate, correlate, and consolidate cyber threat intelligence feeds and sources into a unified, actionable intelligence picture.
• Analysis: Identify spoofed/lookalike domains, brand impersonation, leaked credentials, infrastructure exposures, publicly exposed assets, and map threat actor TTPs to MITRE ATT&CK.
• Threat Impact Assessment: Analyze the likelihood that an emerging threat will affect the organization, identify weaknesses/exposures it could exploit, and assess the potential operational impact on Nebius.
• Incident Investigation: Support Provide intelligence support to the SOC / cybersecurity teams during security incidents: enrich observed IOCs, perform attribution to known threat actors where possible, supply context on expected TTPs, and monitor external sources for additional signals related to the incident.
• Threat Hunting Support: Support intelligence-driven hunt missions to augment detection capabilities and identify threats across the environment.
• Threat Actor Tracking: Document activity, campaigns, and TTPs of threat groups relevant to Cloud/AI infrastructure.
• IOC Management: Collect, validate, structure, defang, and prioritize indicators with source attribution and confidence levels.
• Watchlist Maintenance: Continuously update the search-term dictionary, monitored domains, brands, and intelligence watchlists used for threat monitoring.
• Documentation & Reporting: Write findings following the standard report format (BLUF, key findings, assessment, IOC feed, source coverage, and confidence level) as input to the Lead.
• Intelligence Hygiene: Log false positives separately (what was found, why dismissed), maintain proper TLP classification, and clearly distinguish verified facts from analytical assessment.

We expect you to have:

• Understanding of CTI methodology and the intelligence cycle.
• Hands-on familiarity with OSINT tools (Shodan, Censys, crt.sh, VirusTotal, etc.).
• Experience working with intelligence systems/platforms and handling an alert stream (triage), including consolidating multiple feeds.
• Experience validating intelligence across multiple independent sources.
• Understanding of the MITRE ATT&CK framework and TTP mapping.
• Ability to support incident investigations and hunt missions, working closely with the SOC in real time.
• Analytical capabilities of logical reasoning, critical thinking, and problem-solving.
• Critical analytical thinking – verifying findings across multiple sources, avoiding jumping to conclusions, and distinguishing fact from inference.
• Concise technical writing ability (BLUF, structured reports).
• Understanding of common attack techniques targeting Cloud infrastructure.

It will be an added bonus if you have:

• Experience with Cloud/AI infrastructure.
• Experience with Digital Risk Prevention (DRP), external attack surface monitoring, or brand monitoring.

Benefits & Perks:

• Competitive compensation
• Career growth and learning opportunities
• Flexibility and ownership
• Collaborative and innovative culture
• Opportunity to work on impactful AI projects
• International environment and talented teams

What's it like to work at Nebius:

• Fast moving
• Bold thinking
• Constant growth
• Meaningful impact
• Trust and real ownership
• Opportunity to shape the future of AI

Equal Opportunity Statement:

Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law.

Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.

If you need accommodations during the application process, please let us know.