Join the mission to make the digital world safer.
About Team Cymru
Team Cymru's mission is to save and improve human lives by helping public and private sector analysts track and take down cybercriminals. We provide visibility into global cyber threat activity and are a key intelligence source for leading cybersecurity and threat intelligence vendors.
Our Pure Signal™ platform gives enterprise security teams on-demand access to global internet traffic telemetry, providing clarity into what's happening across the internet with a level of visibility comparable to their own internal networks. This allows organizations to close detection gaps, accelerate incident response, and get ahead of critical, recurring threats.
Team Cymru is a fast-paced, distribution-focused, private equity-backed company where your work directly supports a mission that protects millions worldwide.
We're looking for a Threat Detection Analyst to serve as the bridge between detection engineering and intelligence research. You'll develop and guide custom detections for the most active network-based threats, while writing for both practitioner and senior leadership audiences. Your work will power our analytical tools, data analytics systems, and analysis automation, and will help our customers complete their security and intelligence missions effectively. This role suits an analyst who has strong analytic tradecraft, is technically proficient, and is energized by the mission-driven, high-signal nature of threat intelligence work.
Key Responsibilities:
Detection Engineering
- Translate research findings into durable detection rules and processes that build automated tracking mechanisms for ongoing monitoring of threats and adversary groups
- Generate detection rules for network infrastructure based on internal datasets, including PDNS, X.509, service banners, NetFlow, and more
- Develop multi-stage infrastructure detection processes involving sophisticated queries across multiple datasets and advanced filtering
- Build, maintain, and expand detection process infrastructure on K8s, bare-metal, and virtualized servers
- Conduct quality assurance (QA) reviews on candidate detections developed by teammates
Threat Research
- Conduct proactive research into threat actors, malware families, campaigns, and evolving TTPs to deepen Team Cymru's body of knowledge
- Lead short- and long-term threat tracking projects, identifying intelligence gaps and proposing targeted research to address collection shortfalls
- Perform deep network traffic and infrastructure analysis to support customer requests and independent research, using Team Cymru's unique global dataset
- Analyze PCAP, NetFlow, passive DNS (PDNS), open ports, certificates, and other datasets to map malicious infrastructure and identify related threat actor assets
- Produce written products (internal assessments, customer-facing reports, blog articles, presentations) that clearly communicate threat research to practitioner and senior leadership audiences
Collaboration
- Work closely with colleagues on the development of tools, data analytics systems, research methodologies, and automated analysis capabilities
- Leverage analytic and data expertise to support our Sales and Outreach teams
- Participate in working groups, industry events, and community collaboration as a representative of Team Cymru's intelligence capability
Qualifications & Experience
- 5+ years of experience as a threat intelligence analyst, network forensics analyst, or IT security analyst
- Experience coding with Python, database technologies (e.g. PostgreSQL, ClickHouse), code collaboration tools (e.g. GitLab, GitHub), and AI-assisted development (Claude Code, Codex, etc.)
- Demonstrated experience developing network-level threat detection rules derived from querying and analyzing large, disparate datasets
- Proven track record of leading complex analytical projects, including managing multiple concurrent workstreams
- Experience tracking APT, nation-state, or cybercriminal actors, with the ability to place their activity in a broader geopolitical or strategic context
- Outstanding network infrastructure and traffic analysis skills: PCAP, NetFlow, PDNS, open ports, certificates
- Deep working knowledge of IP networking and internet services: DNS, HTTP/HTTPS, TLS, VPNs, and routing protocols (BGP)
- Strong familiarity with common OSINT platforms and research techniques
- Proven ability to work effectively in a distributed, remote team, including a willingness to conduct peer review and share tradecraft
- Exceptional oral and written communication skills
Additional Skills
- Experience using structured analysis techniques, estimative language, and confidence levels; comfortable forming assessments from incomplete or ambiguous data
- Hands-on experience managing remote Linux servers and engineering custom proof-of-concept tools to extract, simulate, or generate unique threat data
- Working understanding of malware and network analysis: YARA, Zeek, Suricata, sandbox reporting
- Familiarity with using AI systems to rapidly prototype analytical tools and proof-of-concept projects
- Exposure to malware reverse engineering, including static and dynamic analysis and common tooling (e.g. Binary Ninja, Ghidra, IDA Pro, x64dbg)
- Familiarity with the operational structures of hosting providers, ISPs, and internet exchanges, including how infrastructure is provisioned, attributed, and abused by threat actors
Education and Certifications
- Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or equivalent experience (preferred)
Travel
Occasional travel for industry events and customer engagements may be required.
Why Join Team Cymru?
At Team Cymru, we provide unmatched global threat intelligence that empowers organizations to proactively disrupt adversaries. You'll be at the forefront of cybersecurity innovation, helping customers harness the full power of our threat intelligence to achieve critical business and security outcomes.
We offer a collaborative, mission-driven culture where your expertise and impact will directly contribute to improving global security. Our culture is fast-paced, team-oriented, and mission-focused, with ample opportunities to explore, research, and develop new and unique solutions.
We recognize that no candidate will tick every box on this list. If you have strong foundations in threat intelligence and a genuine passion for the work, we encourage you to apply regardless of whether you meet every requirement.
Ready to make an impact? Apply now and join a team protecting millions worldwide.
This job description is not exhaustive. Responsibilities may evolve as needed. Team Cymru is an equal opportunity employer and welcomes applicants from all backgrounds. This is a remote position.
#LI-BR1
5+ years threat intelligence or network forensics experience; Python, PostgreSQL, ClickHouse, GitLab/GitHub; network detection rule development; APT tracking; PCAP, NetFlow, PDNS analysis; strong communication; occasional travel.
Key Responsibilities
- developing detection rules
- conducting threat research
- analyzing network traffic
Skills & Tools
Python, PostgreSQL, ClickHouse, GitLab, GitHub, Claude Code, Codex, PCAP, NetFlow, PDNS, YARA, Zeek, Suricata, Binary Ninja, Ghidra, IDA Pro, x64dbg
Job Details
- Category: Information Technology
- Seniority: Senior Level
- Commitment: Full Time
- Workplace: Remote — United States
- Languages: English
About Team Cymru
A cybersecurity company providing global threat intelligence and visibility into internet traffic telemetry. — Industry: Information Technology