Cyber Security Analyst - Threat Researcher

Role Description

As a Cyber Security Analyst - Threat Researcher at the Associate level, you will independently research assigned cyber threats, vulnerability exploitation pathways, and AI-augmented attacks within SMBC Group’s Cyber Threat Intelligence program, with prioritization and review from senior team members. You will document evidence and analytical confidence, develop visual attack pathway models, and support SOC, vulnerability management, and security engineering teams in identifying detection, threat hunting, and mitigation opportunities relevant to SMBC Group’s technology environment and business services.

Role Objectives

Threat Research & Analysis:
• Research assigned threat actors, malware, and campaigns to identify attack patterns and adversary tactics, techniques, and procedures (TTPs), including emerging threats relevant to financial services.
• Analyze open-source and commercial intelligence and internal telemetry to inform threat models, documenting source credibility, analytical confidence, and intelligence gaps.
• Assess vulnerability advisories, proof-of-concept availability, reported exploitation, and remediation status to identify exploitation prerequisites, potential exposure, and compensating controls relevant to SMBC Group.
• Research AI-assisted reconnaissance, social engineering, impersonation, and malicious code development, distinguishing documented adversary activity from speculative claims, including claims of autonomous capability.
Attack Pathway Modeling:
• Develop and maintain evidence-based visual attack pathways mapped to MITRE ATT&CK techniques, incorporating vulnerability exploitation and AI augmentation where relevant and distinguishing observed behavior from analytical or hypothetical scenarios.
• Map exploitation prerequisites, potential privilege escalation and lateral movement, control dependencies, and business impact to observable activity and defensive intervention points, distinguishing exploit availability from evidence of enterprise compromise.
• Use attack pathways to support detection recommendations, threat hunt hypotheses, authorized simulations, and tabletop exercises, including financial-system scenarios where assigned.

Role Objectives

Tooling & Automation:
• Use available threat intelligence platforms and SIEM data to support research, collection, and analysis.
• Use approved visualization tools to create attack pathway diagrams and ATT&CK Navigator to map technique coverage.
• Support intelligence enrichment and workflow improvements, including basic scripting where applicable.
Reporting & Communication:
• Produce clear, actionable intelligence reports and visualizations for both technical and executive audiences.
• Present research findings and attack pathways in team briefings and contribute to planning discussions.
Collaboration & Integration:
• Work with SOC analysts, vulnerability management, asset owners, security engineering, security testing, cyber resilience, and threat modeling teams to validate exposure assumptions and inform detection, threat hunting, and remediation priorities; implementation remains with the responsible teams.

Qualifications and Skills

Required Qualifications:
• Three or more years of experience in cyber threat intelligence, threat research, or threat hunting within a SOC or information security program.
• Understanding of adversary tactics, techniques, and procedures and familiarity with MITRE ATT&CK.
• Ability to assess vulnerability advisories and exploitation reporting, identify exploitation prerequisites, and explain implications for enterprise exposure and defensive controls.
• Ability to develop clear visual attack pathways or kill chain diagrams.
• Familiarity with open-source or commercial threat intelligence and security telemetry used in threat analysis.
• Strong analytical, written, and verbal communication skills, including evaluating source credibility, documenting evidence and analytical confidence, and managing assigned research priorities.
Preferred Qualifications:
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field.
• Experience reviewing technical exploitation research or supporting authorized vulnerability validation in a controlled lab environment.
• Familiarity with adversary analysis approaches such as the Diamond Model, Cyber Kill Chain, or attack trees.
• Familiarity with KQL or Python for telemetry analysis, intelligence enrichment, or basic workflow automation.
• Experience researching AI-augmented cyber threats and distinguishing demonstrated capabilities from speculative claims.
• Experience in financial services or another regulated industry.
• Relevant threat intelligence or security certifications, such as GCTI or CTIA.