Threat Researcher

Abnormal Security

. Conduct original research into active campaigns, attacker behavior, and emerging email and identity attack techniques .

Posted 10/23/2026full-timeRemote • United StatesMid-LevelSenior💰 $122,400 - $176,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat intelligence, including the ability to conduct complex investigations, synthesize technical research into actionable insights, and communicate findings effectively to diverse audiences. Proficient in utilizing AI tools and threat intelligence platforms to enhance research and analysis capabilities.

Highest-signal resume keywords

Threat Intelligence AnalysisEmail And Identity Attack TechniquesAI Tools ProficiencyStrong Writing SkillsProject Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat IntelligenceSecurity ResearchSQL ProficiencyMITRE ATT&CK FrameworkAnalytical ReportingTechnical Narrative DevelopmentData SynthesisIncident ResponsePhishing DetectionThreat Hunting

Soft Skills

Analytical JudgmentCommunication SkillsCollaborationMentoringPrioritization

Tools & Technologies

Abnormal's PlatformAI ToolsThreat Intelligence PlatformsAutomation ToolsCustomer Engagement Tools

Certifications & Qualifications

Security+GIACCISSPCEH

Industry Keywords

SOC OperationsAttack CampaignsIndicators Of Compromise (IOCs)Tactics, Techniques, And Procedures (TTPs)Email SecurityCustomer SuccessCross-Functional CollaborationPublic-Facing Security Content

Tech Stack

Tools & technologies

Cyber SecurityPythonSQL

About the role

Key responsibilities & impact

Conduct original research into active campaigns, attacker behavior, and emerging email and identity attack techniques
Scope and lead complex or ambiguous threat intelligence investigations
Use Abnormal's platform, internal telemetry, threat intelligence sources, and external research to investigate threats
Identify meaningful patterns, connections, and emerging trends across threat activity
Develop defensible intelligence assessments and recommendations
Synthesize complex intelligence from disparate sources into audience-tailored narratives
Translate raw findings into insights, implications, recommendations, and clear narratives
Produce threat briefs, analytical reports, customer QBR content, customer and prospect briefings, webinars, presentations, marketing content, and executive summaries
Create rapid-turnaround intelligence products and deeper analytical work
Build reusable narratives, templates, and content structures
Lead customer and prospect intelligence engagements, including briefings, webinars, and presentations
Respond to time-sensitive customer questions and high-priority pursuits
Collaborate with Threat Intelligence, Detection, Sales, Customer Success, and Marketing teams
Mentor P1 and P2 analysts through coaching, peer review, and knowledge sharing
Provide enablement materials for go-to-market teams
Feed customer and field insights back to Threat Intelligence teams
Use AI tools and automation to accelerate research, synthesis, drafting, tailoring, and editing while applying human review and validation

Requirements

What you’ll need

4+ years of experience in threat intelligence, SOC operations, or a closely related cybersecurity discipline
Working knowledge of email and identity attack techniques, IOCs, TTPs, attack campaigns, and threat behavior
Experience conducting security research and producing written intelligence or security content for different audiences
Ability to synthesize technical research and data from multiple sources into intelligence assessments, narratives, and recommendations
Analytical judgment in complex or ambiguous investigations and ability to evaluate incomplete or conflicting evidence
Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts
Strong writing skills for communicating complex technical subjects clearly and concisely
Ability to present complex technical intelligence to customers, executives, security practitioners, or other stakeholders
Experience working directly with customers or cross-functional stakeholders and translating technical findings into business relevance
Proficiency with AI tools such as ChatGPT, Claude, Claude Code, Copilot, or similar tools
Strong project management and prioritization skills
Ability to remain calm, accurate, and responsive in high-pressure or time-sensitive situations
Ability to independently scope, prioritize, and deliver complex intelligence work from investigation through customer-ready communication
Ability to strengthen other analysts' technical capabilities through peer review, knowledge sharing, coaching, and collaborative problem-solving
Demonstrated use of AI tools or automation to scale research, analysis, or content production
Working knowledge of the MITRE ATT&CK framework and common attack techniques, including phishing, BEC, credential harvesting, malware, and account takeover
Basic proficiency in SQL, including writing and modifying queries
Nice to have: experience in email security, phishing detection, anti-abuse systems, email threat containment, detection engineering, incident response, Abnormal Security or similar platforms, public-facing security content, customer-facing security engagements, training or enablement materials, mentoring analysts, Python or scripting, and security certifications such as Security+, GIAC, CISSP, or CEH

Benefits

Comp & perks

Bonus or incentive compensation eligibility
Equity eligibility
Comprehensive benefits package
Pre-employment checks conducted in line with applicable legislation and company policies