Remote Threat Detection Engineer

Team Cymru; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Team Cymru is seeking a seasoned threat intelligence analyst to join our remote team. You will conduct proactive threat research, develop detection rules, and analyze network data across PDNS, NetFlow, PCAP, and TLS. Strong coding in Python, SQL databases, and experience with large datasets are essential.

You’ll collaborate across groups to deliver actionable intelligence and client-ready reports. Join a mission-driven company protecting global cyber infrastructure through open collaboration and

Qualifications

• 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
• Experience coding with Python and database technologies (e.g. PostgreSQL, ClickHouse).
• Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets.
• Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams.
• Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context.
• Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates.
• Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP).
• Strong familiarity with common OSINT platforms and research techniques.
• Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft.
• Exceptional oral and written communication skills.

Responsibilities

• Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups.
• Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more.
• Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering.
• Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers.
• Conduct quality assurance (QA) reviews on candidate detections developed by teammates.

Skills

Threat intelligence

Python

Network forensics

PCAP/NetFlow analysis

OSINT

Data analysis

Threat actor tracking

Project leadership

Communication

Big data / SQL databases

Education

Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience

Tools

GitLab

GitHub

Claude Code

Codex

YARA

Zeek

Suricata

Job description

Team Cymru is seeking a seasoned threat intelligence analyst to join our remote team. You will conduct proactive threat research, develop detection rules, and analyze network data across PDNS, NetFlow, PCAP, and TLS. Strong coding in Python, SQL databases, and experience with large datasets are essential.

You’ll collaborate across groups to deliver actionable intelligence and client-ready reports. Join a mission-driven company protecting global cyber infrastructure through open collaboration and