Threat Researcher

The role

You will conduct original research into active campaigns, attacker behavior, and emerging email and identity attack techniques. You will synthesize technical research and data into intelligence products like threat briefs, analytical reports, and presentations for various audiences.

What you will do

• Lead complex threat intelligence investigations into active campaigns and attacker behavior.
• Use platform telemetry, internal data, and external research to develop intelligence assessments.
• Identify meaningful patterns and emerging trends across threat activity.
• Synthesize complex intelligence from disparate sources into clear assessments.
• Translate raw findings into insight, implications, and recommendations.
• Produce intelligence deliverables including threat briefs, reports, and webinars.
• Lead customer and prospect intelligence engagements and briefings.
• Collaborate with Threat Intelligence, Detection, Sales, Customer Success, and Marketing teams.
• Mentor P1 and P2 analysts through coaching and peer review.
• Use AI tools to accelerate research, synthesis, and drafting.

Required qualifications

• 4+ years of experience in threat intelligence, SOC operations, or a closely related cybersecurity discipline.
• Working knowledge of email and identity attack techniques.
• Ability to understand and explain IOCs, TTPs, attack campaigns, and threat behavior.
• Experience conducting security research and producing written intelligence or security content.
• Ability to synthesize technical research and data into clear assessments and narratives.
• Demonstrated analytical judgment in complex or ambiguous investigations.
• Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts.
• Strong writing skills.
• Ability to independently present technical intelligence to stakeholders.
• Experience working directly with customers or cross-functional stakeholders.
• Proficiency with AI tools such as ChatGPT, Claude, Claude Code, or Copilot.
• Strong project management and prioritization skills.

Nice to have

• Experience in email security, phishing detection, anti-abuse systems, or email threat containment.
• Experience in detection engineering, incident response, and email security analysis.
• Experience with Abnormal Security or similar security platforms.
• Public-facing security content experience, such as published research, blogs, conference talks, webinars, or industry reports.
• Experience creating intelligence content for sales cycles, customer QBRs, or other customer-facing security engagements.
• Experience creating training or enablement materials for Sales, Customer Success, or other non-technical teams.
• Experience mentoring, coaching, or training earlier-career security analysts.
• Experience using Python or other scripting tools to automate data analysis or research workflows.
• Security certifications such as Security+, GIAC (GCTI, GCIH), CISSP, CEH, or similar.

Benefits

• Base salary
• Bonus or incentive compensation
• Equity
• Comprehensive benefits package

Before you apply

• If your application is successful, Abnormal AI will carry out pre-employment checks which must be successfully completed to progress to a final offer.

About the company

Abnormal AI is looking for a Threat Researcher to join its Threat Intelligence team.