Abnormal Security Threat Researcher conducts original research into active campaigns and emerging email and identity attack techniques. This role synthesizes intelligence to produce actionable insights for diverse audiences.
Responsibilities
Abnormal AI is looking for a Threat Researcher to join our Threat Intelligence team.
This is an analyst role for someone who is equally interested in understanding threats and figuring out how to make intelligence useful.
That might mean a concise threat brief for a security practitioner, a deeper analytical report, tailored intelligence content for Customer Success to use in a customer QBR, a briefing for a prospect, a webinar for a broader audience, or content supporting a high-priority sales pursuit.
The defining skill for this role is intelligence synthesis: combining technical research, data, threat context, and audience needs into a clear assessment and compelling narrative.
Success in this role is not measured by how many documents you produce. It is measured by whether you can identify the important intelligence, explain what it means, and put it in a form that helps the audience understand and act on it.
Analyze & Research
Independently scope and lead complex or ambiguous threat intelligence investigations into active campaigns, attacker behavior, TTPs, and emerging email and identity attack techniques. Determine appropriate research approaches, evaluate incomplete or conflicting evidence, and develop defensible intelligence assessments with limited direction.
Use Abnormal's platform, internal telemetry and data, threat intelligence sources, and external research to investigate threats and develop intelligence assessments.
Identify meaningful patterns, connections, and emerging trends across threat activity.
Develop a strong understanding of how Abnormal detects and responds to the threats you analyze.
Synthesize Intelligence
Independently synthesize complex and sometimes conflicting intelligence from disparate sources, determine the most consequential insights, and develop defensible assessments and recommendations tailored to the audience and decision at hand.
Qualification
Strong writing skillsAbility to remain calmExperience in email securityExperience in detection engineeringExperience mentoring
Required
4+ years of experience in threat intelligence, SOC operations, or a closely related cybersecurity discipline.
Working knowledge of email and identity attack techniques and the ability to understand and explain IOCs, TTPs, attack campaigns, and threat behavior.
Demonstrated experience conducting security research and producing written intelligence or security content for different audiences.
Strong ability to synthesize technical research and data from multiple sources into clear intelligence assessments, narratives, and recommendations.
Demonstrated analytical judgment in complex or ambiguous investigations, including the ability to evaluate incomplete or conflicting evidence, determine the most consequential findings, and develop defensible assessments and recommendations with limited direction.
Familiarity with threat intelligence platforms, intelligence-sharing communities, and threat hunting concepts.
Strong writing skills, with the ability to communicate complex technical subjects clearly and concisely.
Demonstrated ability to independently present complex technical intelligence to customers, executives, security practitioners, or other stakeholders, adapting communication to the audience and responding confidently to questions or challenges.
Experience working directly with customers or cross-functional stakeholders and translating technical findings into business relevance.
Demonstrated proficiency with AI tools such as ChatGPT, Claude, Claude Code, Copilot, or similar tools to enhance research, analysis, and writing.
Strong project management and prioritization skills, with the ability to manage competing requests and deliver high-quality work on time.
Ability to remain calm, accurate, and responsive in high-pressure or time-sensitive situations.
Preferred
Experience in email security, phishing detection, anti-abuse systems, or email threat containment.
Experience in detection engineering, incident response, and email security analysis.
Experience with Abnormal Security or similar security platforms.
Public-facing security content experience, such as published research, blogs, conference talks, webinars, or industry reports.
Experience creating intelligence content for sales cycles, customer QBRs, or other customer-facing security engagements.
Experience creating training or enablement materials for Sales, Customer Success, or other non-technical teams.
Experience mentoring, coaching, or training earlier-career security analysts.
Experience using Python or other scripting tools to automate data analysis, investigate threat activity, or improve intelligence research workflows.