Conduct in-depth analysis and research to attribute cyber threats and attacks, including identifying threat actors, their motivations, tactics, techniques, and procedures (TTPs), and providing insights on their potential impact on the organization. Collaborate with internal and external stakeholders, to gather and share relevant threat intelligence for attribution purposes.
Ability to classify, categorize, and analyze malware and threats.
Monitor and assess the global threat landscape, including threat actors, malware, hacking techniques, and geopolitical events that may impact the organization.
Collaborate with internal teams to provide timely and actionable intelligence to support incident response, vulnerability management, and other cybersecurity initiatives.
Develop and maintain threat profiles, indicators of compromise (IOCs), and tactical reports to enhance detection and response capabilities.
Perform root cause analysis and provide recommendations for proactive measures to help prevent future cyber attacks.
Continuously update and refine existing threat intelligence processes and methodologies to ensure the organization remains at the forefront of cyber defense.
Stay informed about the latest trends, tools, and techniques in the field of threat intelligence and incorporate best practices into daily operations.
Present findings and insights to technical and non-technical stakeholders, including executives, to enhance overall cyber risk awareness.
Adapts quickly to changing priorities, seeks new ideas, and re-align with team鈥檚 priority/roadmap to maximize business productivity.
Technical & Soft Skills:
Good understanding of cyber threats, attack vectors, and common exploitation techniques.
Proficiency in using threat intelligence platforms, open-source tools, and SOC technologies such as Google Chronicle SIEM, CrowdStrike EDR/EPP, Vectra NDR, Qualys VM, Recorded Future TI, etc.
Good understanding of security frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) and current threat landscapes.
Proficiency with scripting (Python, PowerShell, etc.) and automating threat detection or hunting tasks.
Ability to proactively find cybersecurity threats and mitigate them.
Ability to obtain as much information on threat behaviour, goals and methods as possible.
Knowledge about Advanced persistent threats and treat actors, their TTPs. Ability to recognize attack patterns and corelate them with specific threat actors.
Knowledge of Analytics platforms for carrying out detailed analytics of obtained telemetry.
Strong understanding of Windows, Linux, and network protocols.
Good knowledge of industry frameworks and standards, such as STIX/TAXII, MITRE ATT&CK, and threat intelligence sharing platforms.
Excellent written and verbal communication skills, including the ability to present complex technical information to both technical and non-technical audiences.
Strong analytical and critical thinking skills, with the ability to analyze complex data sets and identify actionable insights.