Sr Threat Intelligence Investigator

Oracle; Austin (TX); On-site; USD 104,000 - 235,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan with company match

Paid time off

Paid holidays

Parental leave

Flexible spending accounts

Commuter benefits

Job summary

Oracle is seeking a Threat Intelligence Investigator to track threat actors and lead operational activities across the OCI environment. You will manage large datasets, produce intelligence products, and adapt to an fast-paced environment while collaborating with security teams and customers.

The role emphasizes tracking APT groups, leveraging OSINT, and developing detection signatures to strengthen Oracle’s defenses, with opportunities to influence strategic security decisions globally.

Qualifications

• Requires 6-10+ years in analytical threat intel and operations.
• Experience tracking distinct APT groups and their methodologies.
• Strong OSINT research across topics.
• Proficient in detecting and attributing threat activity.

Responsibilities

• Lead investigations through in depth analysis and collection efforts.
• Provide detailed attribution analyses for threat actors.
• Communicate complex technical matters to non-technical audiences.
• Coordinate post-incident reviews and drive remediation actions.
• Stay updated on emerging threats and adapt defenses accordingly.
• Manage threat intelligence platforms and related tools.
• Collaborate with cloud security teams during incident response.
• Develop intelligence processes for timely delivery of reports.
• Elevate analytic quality with peer review and feedback.
• Handle high volume, time-sensitive intelligence requests.

Skills

Threat intelligence

APT tracking

OSINT research

Log analysis

Threat attribution

Communication skills

Education

Bachelor or Master in CS/CE/Cybersecurity

Tools

YARA

Snort

Suricata

Bro/Zeek

Job description

Job Description

The Oracle Threat Intelligence Center (OTIC) is responsible for the tracking and monitoring of a range of threat actors from cybercrime to Advanced Persistent Threat (APT) groups impacting OCI and its customers. The scope and responsibility of this team includes attack analysis, tracking threat actor's indicators of compromise (IOCs) and their tactics, techniques, and procedures (TTPs), aiding in security incident response, executive communication, technical writing, and customer outreach.

Job Description

The Oracle Threat Intelligence Center (OTIC) is responsible for the tracking and monitoring of a range of threat actors from cybercrime to Advanced Persistent Threat (APT) groups impacting OCI and its customers. The scope and responsibility of this team includes attack analysis, tracking threat actor's indicators of compromise (IOCs) and their tactics, techniques, and procedures (TTPs), aiding in security incident response, executive communication, technical writing, and customer outreach.

As a Threat Intelligence Investigator, you will be responsible for tracking the activities of threat actors. This includes independently tracking numerous groups and leading operational activities during relevant situations. You will be expected to handle large and complex datasets and develop new solutions to enhance your tracking and analysis capabilities. You will also have a passion for cybersecurity, with a strong interest in researching and investigating current threat trends, emerging threats, and actors. This role requires the ability to produce intelligence products and adapt to an organic and fast-paced environment.

Responsibilities

Key Responsibilities

• Leadinvestigations through in depth analysis and collection efforts of suspected adversary campaigns across the OCI environmentto deliver timely, actionable intelligence and create effective remediation strategies within the OCI environment.
• Provide detailed attribution analysisto identify threat actors and inform proactive defense strategies
• Manage cross-company and executive communications, explaining intricate technical matters to non-technical audiences.
• Facilitate post-incident reviewsto extract lessons learned, document new threat intelligence, and drive resolution actions with impacted teams.
• Stay up to date on emerging threats, vulnerabilities, security technologies, and global geopolitical issues to assess their potential impact and proactively enhance Oracle’s defenses.
• Manage and maintain threat intelligence platforms (TIPs)and other cyber threat intelligence (CTI) related tools to enrich data and streamline workflows.
• Collaborate with partner Cloud security teams during all phases of the incident response lifecycle tointegrate intelligence findings into resolution and mitigation plans.
• Cultivate strategic relationshipswith key members of the Threat Intelligence community to expand access to information and strengthen trust networks.
• Develop and refine intelligence processesto ensure the timely and accurate delivery of strategic, operational, and tactical intelligence.
• Elevate analytic quality and reporting standardsby providing critical peer review and strategic feedback to fellow investigators.
• Manage and executea high volume of time-sensitive intelligence requests from internal and external customers by prioritizing, categorizing, and delivering timely and accurate information.
• Deliver finished intelligence analysis and assessmentsto internal and external customers through written reports, demonstrating expertise and enabling informed decision-making.

Preferred Qualifications

• 6-10+ years of industry experiencein analytical and operational threat intelligence to perform case management and response against advanced persistent threats (APTs).
• Investigative experience tracking distinct APT groups providing intelligence on their methodologies.
• Expertise in one or more of the following areas: national security, defense, intelligence, law enforcement, or foreign area and language expertise relevant to threat analysis
• Knowledge of cloud services such as storage, computing, networking
• In-depth knowledge of multiple operating systems, including Windows, UNIX/Linux, and macOS, and familiarity with associated threat landscapes.
• Skilled in conducting open-source intelligence (OSINT) research across a wide range of topics.
• Strong verbal, written, and interpersonal communication skills, with demonstrated ability to convey complex technical information to diverse, non-technical stakeholders.
• Prior experience in Incident Response, Security Operations Center (SOC), and/or Digital Forensics Analysis.
• Experience with malware analysis is highly desirable.
• Strong understanding of common attack types, vectors, and corresponding mitigations.
• Proficient in using structured queries to extract data from logs and in developing detection signatures (e.g., YARA, Snort, Suricata, Bro/Zeek).
• Bachelor or Master of Science degree in Computer Science, Computer Engineering, Information Systems, Cybersecurity, or equivalent practical experience.
• Previous experience working on a global or geographically distributed security team is a plus.
• Active TS/SCI security clearance

Qualifications

Disclaimer:

Certain U.S. based or U.S. customer or client-facing roles may be required to comply with applicable requirements, such as immunization/occupational health mandates, and/or drug testing requirements.

Range and benefit information provided in this posting are specific to the stated locations only

US: Hiring Range in USD from: $104,200 - $234,600 per year. May be eligible for bonus, equity, and compensation deferral.

Oracle maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect Oracle's differing products, industries and lines of business.

Candidates are typically placed into the range based on the preceding factors as well as internal peer equity.

• Medical, dental, and vision insurance, including expert medical opinion
• Short term disability and long term disability
• Life insurance and AD&D
• Supplemental life insurance (Employee/Spouse/Child)
• Health care and dependent care Flexible Spending Accounts
• Pre-tax commuter and parking benefits
• 401(k) Savings and Investment Plan with company match
• Paid time off: Flexible Vacation is provided to all eligible employees assigned to a salaried (non-overtime eligible) position. Accrued Vacation is provided to all other employees eligible for vacation benefits. For employees working at least 35 hours per week, the vacation accrual rate is 13 days annually for the first three years of employment and 18 days annually for subsequent years of employment. Vacation accrual is prorated for employees working between 20 and 34 hours per week. Employees working fewer than 20 hours per week are not eligible for vacation.
• 11 paid holidays
• Paid sick leave: 72 hours of paid sick leave upon date of hire. Refreshes each calendar year. Unused balance will carry over each year up to a maximum cap of 112 hours.
• Paid parental leave
• Adoption assistance
• Employee Stock Purchase Plan
• Financial planning and group legal
• Voluntary benefits including auto, homeowner and pet insurance

The role will generally accept applications for at least three calendar days from the posting date or as long as the job remains posted.

Career Level - IC4

About Us

Only Oracle brings together the data, infrastructure, applications, and expertise to power everything from industry innovations to life-saving care. And with AI embedded across our products and services, we help customers turn that promise into a better future for all. Discover your potential at a company leading the way in AI and cloud solutions that impact billions of lives.

True innovation starts when everyone is empowered to contribute. That’s why we’re committed to growing a workforce that promotes opportunities for all with competitive benefits that support our people with flexible medical, life insurance, and retirement options. We also encourage employees to give back to their communities through our volunteer programs.

We’re committed to including people with disabilities at all stages of the employment process. If you require accessibility assistance or accommodation for a disability at any point, let us know by emailing [e-mail] or by calling 1-888-404-2494 in the United States.

Oracle is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability and protected veterans’ status, or any other characteristic protected by law. Oracle will consider for employment qualified applicants with arrest and conviction records pursuant to applicable law.