Senior Threat Intelligence Analyst -UK

We need to output HTML fragment with sections: About the role? Actually the posting includes "About Team Cymru" and "Job Description". The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. We need to include sections only when posting has real specific content. We have content for: About Team Cymru (maybe "About the role"? Actually "About Team Cymru" is about the company, not role. Could map to "About the role"? But they gave examples: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We can use headings that match content: maybe "About Team Cymru" is not exactly in list but we could use "About the role"? However they said use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). That suggests we should use those exact headings when appropriate. The posting has "About Team Cymru" which is about the company, not role. Could we treat that as "About the role"? Might be okay but better to follow instruction: use those headings. The posting includes sections: Job Description (intro), Responsibilities, Qualifications & Experience, Additional Skills, Highly Desirable Skills, Travel, Why Join Team Cymru? Also mentions remote position. We need to decide which headings to include: About the role (maybe combine About Team Cymru and Job Description?), Responsibilities, Requirements (maybe Qualifications & Experience), Skills (Additional Skills + Highly Desirable Skills), Benefits (Why Join Team Cymru?), Pay (none), Schedule (none). Travel could be maybe part of Schedule? Not exactly. Travel is occasional travel required; could be included under Schedule? But they said only include Schedule if posting actually states them. It does mention travel occasional, but not schedule like hours. Could treat travel as part of Schedule? Might be okay but they said Schedule section only if posting actually states them. It does state travel occasional, which is a schedule aspect. Could include Schedule with that info. We must not include boilerplate like EEO, equal opportunity, scam warning, application instructions, cookie/navigation/legal. At end there is "Team Cymru is an equal opportunity employer..." and "This is a remote position." The remote position is relevant; we could include maybe under Schedule? Or maybe a separate note? But we should not include EEO boilerplate. So we drop that line. We need to preserve all substantive information. So we need to include details about responsibilities, qualifications, skills, desirable skills, travel, why join, remote. We must not invent or summarize away detail. So we need to keep specifics. We'll produce HTML with sections:

About the role

maybe containing the "About Team Cymru" and "Job Description" paragraphs combined? But we need to avoid duplication. The "About Team Cymru" paragraph is about the company; "Job Description" includes mission statement. Could combine into prose. Better:

About the role

Join the mission to make the digital world safer. About Team Cymru Team Cymru is the leader in Internet Threat Intelligence... (the paragraph). Then Job Description paragraph: Team Cymru analysts make a difference every day... etc. We'll combine. Then

Responsibilities

with

• each bullet from Responsibilities section (Threat Research, Network and Infrastructure Analysis, Reporting, Collaboration). Need to preserve bullet points exactly as given. Then

  Requirements

  maybe for Qualifications & Experience. Use
  • for each bullet. Then

    Skills

    maybe combine Additional Skills and Highly Desirable Skills? Could separate but they said prefer few substantive sections over many thin ones. Could combine all skills into one Skills section with subheadings? But we cannot add extra headings besides h3? We could still have

    Skills

    and then within that we could have

    for prose and

    for lists. Could separate Additional Skills and Highly Desirable Skills as two
    maybe with a preceding

    indicating which. That's okay. Then

    Benefits

    for Why Join Team Cymru? Provide prose. Then

    Schedule

    for Travel and remote position. Could include bullet: Occasional travel within the UK and internationally for customer workshops, industry events, and team meetings is required. This is a remote position. We must not include headings with filler like "Pay". Omit. Now ensure we don't repeat job title as heading. Not needed. Now produce HTML fragment. Let's extract exact text. About Team Cymru paragraph: "Join the mission to make the digital world safer. About Team Cymru Team Cymru is the leader in Internet Threat Intelligence. Our unique and global insight empowers an amazing team of analysts to develop industry leading intelligence that is critical to the success of our customer's cyber security efforts. Team Cymru is an ardent supporter of the Threat Intelligence community. We enable industry collaboration by hosting exclusive conferences each year. Our team members actively participate in working groups, attend industry events, and work directly with fellow community peers." Job Description paragraph: "Team Cymru analysts make a difference every day, leading in the battle against those intent on harming others. We are passionate about our mission, and we are looking for an additional teammate who shares in that passion. Do you have a strong background in analytic tradecraft, deductive reasoning, and critical thinking? Would you like to have access to our industry leading threat intelligence data? Are you a proven teammate, mentor, and technical leader? Would you like to join the battle and make a difference in the world? If so, opportunity knocks. Team Cymru analysts work on research and reporting pertaining to our customers' security and intelligence requirements, empowering them to complete their mission effectively and efficiently. Additionally, our analysts undertake research into other threats and work closely with our engineering teams in the development of our world class analytical tools, data analytics systems, and analysis automation, as well as adding to the body of knowledge of those threats. As a Senior Threat Intelligence Analyst, you will provide that vital bridge between technical and strategic intelligence research, writing for both practitioner and senior leadership audiences to understand the impact of the threat, while explaining the technical details and rationale behind those assessments, the best of both worlds!" Now Responsibilities bullets: - Threat Research Conduct extensive, proactive research into threat actors, malware families, campaigns, and evolving TTPs to maintain relevance and deepen Team Cymru's body of knowledge Investigate and present operational and strategic intelligence on threat actors, including attribution, motivation, capability assessment, and geopolitical context Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls Evaluate tools, methodologies, and best practices for understanding adversary TTPs, and proactively share knowledge and techniques with peers - Network and Infrastructure Analysis Perform deep network traffic and infrastructure analysis to support both customer requests and independent research, using Team Cymru's unique global dataset Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets Identify and refine indicators of compromise (IOCs) and threat actor TTPs, translating these into automated tracking mechanisms where possible to enable ongoing monitoring of threats and adversary groups - Reporting Receive, triage, and respond to customer requests with timely, written technical threat intelligence reports tailored to the customer's specific threat landscape and intelligence requirements Ensure all finished intelligence products meet Team Cymru's analytic standards: clear structure, appropriate use of estimative language and confidence levels, and actionable conclusions Conduct peer review of colleagues' reporting to maintain consistency, accuracy, objectivity, and analytic rigor across all published products - Collaboration Work closely with colleagues in the development of analytical tools, data analytics systems, research methodologies, and analysis automation capabilities Support our threat detection and data acquisition teams to align signature development and telemetry collection with overarching threat intelligence priorities Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability Now Qualifications & Experience bullets: - 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst - Preferably, a Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent - Exceptional oral and written communication skills, with the ability to produce customer-facing intelligence reports under time pressure. - Experience using structured analysis techniques, estimative language, and confidence levels is preferred - Proven track record of leading complex analytical projects or investigations, including the ability to manage multiple concurrent work streams Additional Skills bullets: - Well-developed analytical, deductive reasoning, and critical thinking skills; comfortable forming assessments from incomplete or ambiguous data - Proven ability to work effectively within a distributed, remote team environment, including willingness to conduct peer review and share tradecraft knowledge - Experience tracking APT, nation-state, or cybercriminal actors, with the ability to contextualize their activity within the broader geopolitical or strategic landscape - Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates - Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP) - Demonstrated knowledge of operating system concepts, including experience developing and contextualizing indicators of compromise and understanding their deployment in host and network-level detection architectures - Working proficiency in SQL and querying and analyzing large disparate datasets - Strong familiarity with common OSINT platforms and research techniques Highly Desirable Skills bullets: - Subject Matter Expert (SME) for a specific regional or threat actor group, with demonstrable depth in their TTPs, infrastructure patterns, and campaign history - Programming or scripting proficiency, preferably Python, for data processing, automation, or tool development - Confident and skilled public speaker with experience presenting technical research to large audiences at industry conferences or similar forums - Familiarity with using AI systems to rapidly prototype analytical tools and develop proof-of-concept projects - Hands-on experience managing remote Linux servers and engineering custom Proof-of-Concept tools to extract, simulate, or generate unique threat data - Working understanding of malware analysis and network analysis: YARA, Zeek, Suricata, Sandbox reporting - Exposure to malware reverse engineering, including static and dynamic analysis techniques and common tooling (e.g. Ghidra, IDA Pro, x64dbg) - Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors Travel: "Occasional travel within the UK and internationally for customer workshops, industry events, and team meetings is required" Remote: "This is a remote position." Why Join Team Cymru? paragraph: "At Team Cymru, we provide unmatched global threat intelligence that empowers organizations to proactively disrupt adversaries. You'll be at the forefront of cybersecurity innovation, helping customers harness the full power of our threat intelligence to achieve critical business and security outcomes. We offer a collaborative, mission-driven culture where your expertise and impact will directly contribute to improving global security. Ready to make an impact? Apply now and help shape the financial future of a company protecting millions worldwide. This job description is not exhaustive. Responsibilities may evolve as needed." We need to remove boilerplate like "This job description is not exhaustive. Responsibilities may evolve as needed." That's maybe okay to keep? It's not boilerplate but it's a generic statement. Might be considered filler? It's not specific. Might be okay to keep but it's not substantive. The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. This sentence is not substantive? It's a generic disclaimer. Might be considered boilerplate? Not sure. Safer to keep? It's not about EEO etc. I'd keep it maybe. But we also need to remove application instructions: "Ready to make an impact? Apply now and help shape the financial future of a company protecting millions worldwide." That's application instruction? It's a