Threat Detection Analyst

Team Cymru; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Team Cymru is seeking a seasoned threat intelligence analyst to join our remote team. You will conduct proactive threat research, develop detection rules, and analyze network data across PDNS, NetFlow, PCAP, and TLS. Strong coding in Python, SQL databases, and experience with large datasets are essential.

You’ll collaborate across groups to deliver actionable intelligence and client-ready reports. Join a mission-driven company protecting global cyber infrastructure through open collaboration and

Qualifications

• 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst.
• Experience coding with Python and database technologies (e.g. PostgreSQL, ClickHouse).
• Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets.
• Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams.
• Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context.
• Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates.
• Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP).
• Strong familiarity with common OSINT platforms and research techniques.
• Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft.
• Exceptional oral and written communication skills.

Responsibilities

• Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups.
• Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more.
• Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering.
• Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers.
• Conduct quality assurance (QA) reviews on candidate detections developed by teammates.

Skills

Threat intelligence

Python

Network forensics

PCAP/NetFlow analysis

OSINT

Data analysis

Threat actor tracking

Project leadership

Communication

Big data / SQL databases

Education

Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience

Tools

GitLab

GitHub

Claude Code

Codex

YARA

Zeek

Suricata

Job description

About Team Cymru

Team Cymru's mission is to save and improve human lives by helping public and private sector analysts track and take down cybercriminals. We provide visibility into global cyber threat activity and are a key intelligence source for leading cybersecurity and threat intelligence vendors.

Our Pure Signal™ platform gives enterprise security teams on-demand access to global internet traffic telemetry, providing clarity into what's happening across the internet with a level of visibility comparable to their own internal networks. This allows organizations to close detection gaps, accelerate incident response, and get ahead of critical, recurring threats.

Team Cymru is a fast-paced, distribution-focused, private equity-backed company where your work directly supports a mission that protects millions worldwide.

Key Responsibilities

Detection Engineering

• Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups
• Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more
• Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering
• Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers
• Conduct quality assurance (QA) reviews on candidate detections developed by teammates

Threat Research

• Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs to deepen Team Cymru's body of knowledge
• Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls
• Perform deep network traffic and infrastructure analysis to support customer requests and independent research, using Team Cymru's unique global dataset
• Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets
• Produce written products (internal assessments, customer-facing reports, blog articles, presentations) that clearly communicate threat research to practitioner and senior leadership audiences

Collaboration

• Work closely with colleagues on the development of tools, data analytics systems, research methodologies, and automated analysis capabilities
• Leverage analytic and data expertise to support our Sales and Outreach teams
• Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability

Qualifications & Experience

• 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst
• Experience coding with Python, database technologies (e.g. PostgreSQL, ClickHouse), code collaboration tools (e.g. GitLab, GitHub), and AI-assisted development (Claude Code, Codex, etc.)
• Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets
• Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams
• Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context
• Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates
• Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP)
• Strong familiarity with common OSINT platforms and research techniques
• Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft
• Exceptional oral and written communication skills

Additional Skills

• Experience using structured analysis techniques, estimative language, and confidence levels; comfortable forming assessments from incomplete or ambiguous data
• Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data
• Working understanding of malware and network analysis: YARA, Zeek, Suricata, sandbox reporting
• Familiarity with AI systems to rapidly prototype analytical tools and proof-of-concept projects
• Exposure to malware reverse engineering, including static and dynamic analysis and common tooling (e.g. Binary Ninja, Ghidra, IDA Pro, x64dbg)
• Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors

Education and Certifications

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience (preferred)

Travel

Occasional travel for industry events and customer engagements may be required.

Why Join Team Cymru?

At Team Cymru, we provide unmatched global threat intelligence that empowers organizations to proactively disrupt adversaries. You'll be at the forefront of cybersecurity innovation, helping customers harness the full power of our threat intelligence to achieve critical business and security outcomes.

We offer a collaborative, mission-driven culture where your expertise and impact will directly contribute to improving global security. Our culture is fast-paced, team-oriented, and mission-focused, with ample opportunities to explore, research, and develop new and unique solutions.

We recognize that no candidate will tick every box on this list. If you have strong foundations in threat intelligence and a genuine passion for the work, we encourage you to apply regardless of whether you meet every requirement.

This job description is not exhaustive. Responsibilities may evolve as needed. Team Cymru is an equal opportunity employer and welcomes applicants from all backgrounds. This is a remote position.