Threat Researcher

About this role

Research active cyber threats, campaigns, and emerging email and identity attack techniques, then synthesize findings into useful intelligence for technical and business audiences. The role combines independent analysis and customer-facing briefings with collaboration across threat intelligence, detection, sales, customer success, and marketing.

About the company

Abnormal Security uses AI to detect and stop email and collaboration attacks such as phishing and business email compromise. It protects enterprises against social engineering and account takeover.

The team

Threat Intelligence team

Stack

What you'll do

• Lead investigations into threat campaigns, attacker behavior, and emerging techniques.
• Synthesize intelligence from internal telemetry, threat sources, and external research into defensible assessments and recommendations.
• Create threat briefs, reports, customer content, presentations, webinars, and executive summaries.
• Lead customer and prospect intelligence engagements and tailor briefings to audience needs.
• Partner with Detection, Sales, Customer Success, and Marketing; share field insights with research teams.
• Coach and mentor earlier-career analysts through peer review and knowledge sharing.
• Use AI tools and automation to accelerate research and content production while validating accuracy.

What we're looking for

• 4+ years of experience in threat intelligence, SOC operations, or a related cybersecurity field.
• Knowledge of email and identity attacks, IOCs, TTPs, campaigns, and common techniques such as phishing, BEC, credential harvesting, malware, and account takeover.
• Experience conducting security research and producing written intelligence for varied audiences.
• Strong analytical judgment and ability to assess incomplete or conflicting evidence independently.
• Ability to explain technical findings as clear, audience-appropriate intelligence and business risk.
• Experience presenting complex technical intelligence to customers, executives, or other stakeholders.
• Familiarity with threat intelligence platforms, intelligence-sharing communities, threat hunting, and MITRE ATT&CK.
• Basic SQL proficiency and demonstrated use of AI tools or automation for research, analysis, or writing.

Nice to have

• Experience in email security, phishing detection, anti-abuse systems, or email threat containment.
• Detection engineering, incident response, or email security analysis experience.
• Experience with Abnormal Security or similar platforms.
• Published security research, blogs, conference talks, webinars, or industry reports.
• Experience supporting customer QBRs, sales cycles, or customer-facing security engagements.
• Experience creating enablement materials or mentoring security analysts.
• Python or other scripting experience; relevant security certifications.