Job details

Threat Intelligence Analyst

Get a free resume review

About the Role

Abnormal Security is looking for a Threat Intelligence Analyst with expertise in threat hunting, detection engineering, and operational intelligence to combat cloud-based phishing attacks, account takeovers (ATO), and business email compromise (BEC). In this role, you will perform threat hunts in Cloud/SaaS environments, extract actionable intelligence, and collaborate with R&D and Engineering teams to enhance security detections and counter evolving adversary tactics.

Who you are

Deeply experienced in Threat Intelligence & Threat Hunting, with a focus on Cloud/SaaS threats.
Strong understanding of phishing, cloud-native threats, and adversary TTPs targeting identity and email security.
Data-driven mindset, with experience analyzing large datasets using SQL, PySpark, and other query-based analysis tools.
Skilled at bridging threat intelligence with engineering teams, ensuring insights translate into effective security controls.
Comfortable working in agile, cross-functional teams, driving threat research into practical security improvements.
Proven ability to present complex technical concepts to both technical and non-technical audiences.
Results-driven, highly collaborative, self-motivated, and adaptable in fast-paced environments.

What you will do

Threat Hunting & Threat Intelligence

Perform threat hunting and investigative research in Cloud/SaaS environments, focusing on email security, phishing, and account takeovers.
Identify MFA bypass techniques, phishing infrastructure, and cloud-native attack methods targeting enterprise SaaS environments.
Fuse internal telemetry, OSINT, and third-party intelligence sources to uncover and disrupt evolving threat actor campaigns.
Develop threat models and attack hypotheses to identify new cloud-focused attack vectors.
Conduct incident triage and investigative support for escalated incidents, providing internal teams with expertise on threat actors’ tools, techniques, and procedures (TTPs).

Detection Engineering

Collaborate with R&D and Engineering teams to translate threat intelligence into scalable detections and mitigations.
Design and refine cloud threat detection logic, hunting queries, and behavioral analytics to identify attacker activity.
Analyze phishing toolkits, adversary infrastructure, and cloud-native attack methodologies to enhance proactive defenses.
Work with product security teams to improve email security and identity protection mechanisms in Cloud/SaaS platforms.

Security Research

Track and analyze threat actor groups, phishing campaigns, and cloud-based attack methodologies.
Provide technical intelligence briefings to R&D and Engineering teams to inform security product improvements.
Partner with internal stakeholders to evaluate emerging threats and recommend security enhancements for SaaS environments.

Must Haves

Deep Expertise: 5+ years in cyber threat intelligence, threat hunting, or security research.
3+ years of experience in threat hunting and threat research within cloud ecosystems.
Expertise in cloud security, SaaS-based attacks, and email security threats (ATO, BEC, phishing, MFA bypass, etc.).

Strong data analysis skills with experience using SQL, PySpark, or other query languages to investigate large-scale threats.
Deep understanding of MITRE ATT&CK, phishing tactics, and adversary infrastructure analysis.
Hands-on experience with email security platforms, cloud threat analytics, and security automation

Collaborative Mindset: Ability to work cross-functionally with other departments such as R&D, Engineering, and Operations to achieve comprehensive cybersecurity coverage.

Nice to Have

Security certifications (GCTI, GCFA, CISSP, or similar).
Experience in security engineering, cloud-native security, or advanced detection development.
Background in threat modeling, adversary emulation, or attacker TTP analysis.
Experience working in high-scale SaaS environments, analyzing large security datasets.

#LI-LB3

Abnormal Security Glassdoor Company Review

4.9

Abnormal Security DE&I Review

4.7

CEO of Abnormal Security

Evan Reiser

Approve of CEO

Average salary estimate

$100000 / YEARLY (est.)

min

max

$80000K

$120000K

If an employer mentions a salary or salary range on their job, we display it as an "Employer Estimate". If a job has no salary data, Rise displays an estimate if available.

What You Should Know About Threat Intelligence Analyst, Abnormal Security

Are you ready to take the lead in revolutionizing cybersecurity? Abnormal Security is on the hunt for a passionate Threat Intelligence Analyst who will be instrumental in tackling cloud-based phishing attacks, account takeovers, and business email compromise. This remote position based in the UK allows you to unleash your expertise in threat hunting and detection engineering. You'll dive into threat analyses within Cloud/SaaS environments, extracting actionable insights to combat evolving adversaries. Collaborating closely with our talented R&D and Engineering teams, your role focuses on enhancing security detections and driving impactful, tactical improvements. If you thrive in fast-paced, agile environments and love bridging the gap between threat intelligence and engineering, this is your opportunity to shine. You’ll be responsible for conducting in-depth investigations, identifying MFA bypass techniques, and designing detection logic that scales. Bringing insights derived from large datasets using SQL and PySpark will be essential in preventing sophisticated attacks. The position not only demands a data-driven mindset but also requires you to present complex concepts clearly to different audiences. Are you ready to join a team that is at the forefront of cybersecurity innovation? If you have over five years of experience in cyber threat intelligence and a collaborative spirit, we would love to hear from you!

Frequently Asked Questions (FAQs) for Threat Intelligence Analyst Role at Abnormal Security

What are the main responsibilities of a Threat Intelligence Analyst at Abnormal Security?

As a Threat Intelligence Analyst at Abnormal Security, your primary responsibilities will include performing threat hunting and investigative research focused on email security in Cloud/SaaS environments. You'll also identify attack techniques, conduct incident triage, and collaborate with R&D and Engineering teams to refine threat detection mechanisms.