Threat Analyst

About the Role

ThreatLocker is seeking a Threat Analyst to join the Threat Intelligence team, driving research and intelligence efforts focused on identifying and investigating new and emerging cybersecurity threats. This role involves tracking advanced persistent threat (APT) adversaries, analyzing tactics, techniques, and procedures (TTPs), conducting malware and infrastructure investigations, and producing high-impact technical intelligence. The Threat Analyst will author technical blog posts, finished intelligence reports, and analyses of the evolving threat landscape while collaborating with Detection Engineering to improve threat detection coverage.

This is an in-office position based in Orlando, FL.

Responsibilities

• Identify and investigate new and emerging cybersecurity threats.
• Track APT adversaries and characterize their tactics, techniques, and procedures (TTPs).
• Conduct malware analysis, reverse engineering, infrastructure investigations, and campaign research.
• Analyze artifacts and telemetry to identify malicious activity and emerging threat patterns.
• Author high-impact technical blog posts covering malicious software, campaigns, and threat research.
• Produce finished intelligence reports on malicious campaigns, threat actor profiles, and threat landscape trends.
• Leverage research findings and collected telemetry to identify potential ThreatLocker Detect coverage deficiencies.
• Collaborate with Detection Engineering team members to improve and expand threat detection coverage.
• Analyze Windows operating system artifacts, including mechanisms associated with persistence, privilege escalation, and defense evasion.
• Apply the MITRE ATT&CK framework to threat research and analysis within enterprise environments.
• Communicate complex technical findings and threat intelligence to both technical and non-technical stakeholders.
• Provide professional insight and recommendations regarding product functionality and roadmap considerations.
• Collaborate effectively with team members across Threat Intelligence, Detection Engineering, and other relevant functions.
• Manage multiple research priorities and meet time-sensitive deadlines.
• Perform other duties as assigned.

Requirements

• Minimum of 3 years of experience in Information Security.
• Minimum of 2 years of experience in malware analysis, reverse engineering, digital forensics, or a related discipline.
• Familiarity with malware analysis and reverse engineering tools such as IDA Pro, Binary Ninja, Detect It Easy, x64dbg, Malcat, HxD, or similar platforms.
• Experience with Windows operating systems and associated forensic artifacts.
• Knowledge of common mechanisms used for persistence, privilege escalation, and defense evasion.
• Familiarity with common parent-child process structures within Windows environments.
• In-depth knowledge of the MITRE ATT&CK framework and its application within enterprise environments.
• Strong understanding of security technologies and their relevant applications within enterprise environments.
• Excellent analytical, critical-thinking, and problem-solving skills.
• Ability to communicate abstract and complex technical concepts to non-technical stakeholders.
• Strong written and verbal communication skills.
• Content development or technical writing experience strongly preferred.
• Self-starting mentality with the ability to work independently and take ownership of research initiatives.
• Ability to perform effectively in a high-pressure environment.
• Ability to collaborate and work effectively in a team setting.
• Strong time management skills with the ability to meet time-sensitive deadlines.
• Confidence in conveying professional opinions regarding product functionality and roadmap considerations.

Qualifications

The following certifications are relevant to this position:

• GIAC Certified Forensic Analyst (GCFA).
• GIAC Certified Incident Handler (GCIH).
• GIAC Certified Intrusion Analyst (GCIA).
• GIAC Reverse Engineering Malware (GREM).
• GIAC Information Security Professional Certification (GISP).

Working Conditions

• The role is primarily performed in an office environment but may require occasional travel to company offices, customer sites, trade shows, or conferences.
• Physical demands may include standing, walking, sitting, reaching, climbing, stooping, kneeling, talking, hearing, and using hands to operate tools or objects.
• Occasional lifting of up to 25 pounds may be required.
• Requires close vision, distance vision, depth perception, and the ability to adjust focus.

A background check and drug/substance screening are required after a conditional offer. Employment proceeds only upon receiving clear results. Randomized drug and substance testing is conducted approximately every 60 days.