Back to jobs
New

Senior Threat Intelligence Analyst (Russia APT Focus)

Boston, MA, Arlington, VA, London, UK, Remote

With 1,000 intelligence professionals, over $300M in sales, and serving over 1,900 clients worldwide, Recorded Future is the world’s most advanced, and largest, intelligence company!

Senior Threat Intelligence Analyst

Strategic and Persistent Threats, Insikt Group, Recorded Future

This Role:

As a Senior Threat Intelligence Analyst on Insikt Group’s Strategic and Persistent Threats (SPT) team, you will lead efforts to track state-sponsored APT campaigns, mentor peers in intrusion analysis, represent Insikt Group’s expertise externally, and support Recorded Future’s Analyst-on-Demand service.

This role involves both proactive monitoring and in-depth research into threat actor infrastructure, tools, and TTPs, as well as the production of high-impact, client-driven finished intelligence. Your focus will be on state-sponsored cyber threats originating from Russia.

What You’ll Do: 

  • Conduct proactive research on state-sponsored APT activity by synthesizing multiple technical datasets to develop novel insights and high-quality reporting
  • Establish and refine methods to track APT campaigns using network, intrusion, and malware analysis
  • Hunt for threat actor infrastructure and activity across diverse technical data sources, leveraging banner data, service metadata, and related technical artifacts
  • Identify, prioritize, and deploy detection mechanisms for command-and-control infrastructure, malware families, and threat groups of interest
  • Continuously evaluate and improve threat intelligence workflows, identifying opportunities to enhance automation, efficiency, and analytic precision
  • Stay up to date on evolving APT tradecraft by regularly reviewing technical publications, blogs, and intelligence from trusted sharing communities
  • Mentor colleagues on intrusion analysis tradecraft and threat intelligence best practices, fostering a culture of knowledge sharing and continuous development
  • Collaborate with geopolitical and regional analysis teams to support cross-functional research
  • Propose and evaluate new data sources and analytical methods to enhance or automate the intelligence cycle
  • Represent Insikt Group externally as a subject matter expert through customer briefings, media engagements, or public research dissemination
  • Collaborate with engineering and data science teams to ensure effective integration of relevant data and analytics into the Recorded Future platform
  • Support customer intelligence needs through Recorded Future’s Analyst-on-Demand service

What You’ll Bring (Required):

  • BA/BS or equivalent experience in Computer Science, Computer Engineering, Information Security, Security Studies, Intelligence, or a related field
  • Preferably 5+ years of experience in Information Security and/or Threat Intelligence
  • Demonstrated experience conducting technical threat analysis and research
  • In-depth knowledge of TCP/IP and other networking protocols and datasets relevant to intrusion and network infrastructure analysis
  • Demonstrated capability in identifying and tracking infrastructure through methods such as banner analysis and metadata correlation
  • Experience with static and dynamic malware analysis, including family attribution and variant clustering
  • Proficiency in scripting (Python preferred, or Go, C, C++, Java) and fluency with common CTI research tools such as Maltego, Jupyter Notebook, the Elastic Stack, and similar tools
  • Proven experience applying structured analytical techniques and intelligence methodologies to assess state-sponsored threat activity, including the intelligence cycle, intelligence writing best practices, and frameworks such as the Diamond Model
  • Familiarity with threat modeling and adversary tracking frameworks such as MITRE ATT&CK, the Cyber Kill Chain, and related models to support campaign clustering, detection development, and strategic reporting
  • Detailed understanding of existing APT groups’ past activities, TTPs, motivations, and targeting patterns
  • Experience with open-source intelligence-gathering tools and techniques
  • Experience working directly with customers, with strong written and verbal communication skills to clearly convey complex technical and non-technical concepts
  • Strong interpersonal and teamwork skills, including working with globally distributed team members

Preferred Qualifications:

  • MA/MS or equivalent experience in Computer Science, Computer Engineering, Information Security, or a related field
  • Experience writing network and endpoint detection signatures
  • Experience with Windows, iOS, Android, macOS, or malware analysis
  • Proficiency in a high-priority foreign language, with preference for Arabic, Chinese, Farsi, Korean, Portuguese, Russian, or Spanish

The base salary range for this full-time position is $127,000 - $160,000.  Our salary ranges are determined by role, level, and location. The range displayed reflects the minimum and maximum target for new hire salaries for the position across all US locations. Within the range, individual pay is determined by state, work location and additional factors, including job-related skills, experience, and relevant education or training. This position may be eligible for incentive compensation, equity, and medical, dental, vision, life insurance and 401K. Your recruiter can share more about the specific details of the compensation and benefit package during the hiring process.

#LI-Remote 

Why should you join Recorded Future?
Recorded Future employees (or “Futurists”), represent over 40 nationalities and embody our core values of having high standards, practicing inclusion, and acting ethically. Our dedication to empowering clients with intelligence to disrupt adversaries has earned us a 4.8-star user rating from Gartner and more than 45 of the Fortune 100 companies as clients.

Want more info? 
Blog & Podcast: Learn everything you want to know (and maybe some things you’d rather not know) about the world of cyber threat intelligence
Linkedin, Instagram & Twitter: What’s happening at Recorded Future
The Record: The Record is a cybersecurity news publication that explores the untold stories in this rapidly changing field
Timeline: History of Recorded Future
Recognition: Check out our awards and announcements

We are committed to maintaining an environment that attracts and retains talent from a diverse range of experiences, backgrounds and lifestyles.  By ensuring all feel included and respected for being unique and bringing their whole selves to work, Recorded Future is made a better place every day.

If you need any accommodation or special assistance to navigate our website or to complete your application, please send an e-mail with your request to our recruiting team at careers@recordedfuture.com 

Recorded Future is an equal opportunity and affirmative action employer and we encourage candidates from all backgrounds to apply. Recorded Future does not discriminate based on race, religion, color, national origin, gender including pregnancy, sexual orientation, gender identity, age, marital status, veteran status, disability or any other characteristic protected by law.

Recorded Future will not discharge, discipline or in any other manner discriminate against any employee or applicant for employment because such employee or applicant has inquired about, discussed, or disclosed the compensation of the employee or applicant or another employee or applicant.

Recorded Future does not administer a lie detector test as a condition of employment or continued employment. This is in compliance with the law of the Commonwealth of Massachusetts, and in alignment with our hiring practices across all jurisdictions.

Notice to Agency and Search Firm Representatives:
Recorded Future will not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to Recorded Future, including those sent to our employees or through our website, will become the property of Recorded Future. Recorded Future will not be liable for any fees related to unsolicited resumes.

Agencies must have a valid written agreement in place with Recorded Future's recruitment team and must receive written authorization before submitting resumes. Submissions made without such agreements and authorization will not be accepted and no fees will be paid.

Create a Job Alert

Interested in building your career at Recorded Future? Get future opportunities sent straight to your email.

Apply for this job

*

indicates a required field

Resume/CV*

Accepted file types: pdf, doc, docx, txt, rtf

Cover Letter

Accepted file types: pdf, doc, docx, txt, rtf

Recorded Future – Candidate Privacy Notice *

This candidate privacy notice explains who we are, why and how we process personal data relating to candidates and, if you are the subject of any of the personal data concerned, your rights and our contact details if you want further information or help.

When you apply for a job on www.recordedfuture.com the personal data contained in your application will be collected and processed by Recorded Future, Inc. (“we, us, our”). For the purposes of European Economic Area data protection law, (the "Data Protection Law"), the data controller is: Recorded Future, Inc., 363 Highland Avenue, Somerville, MA 02144, recruiting@recordedfuture.com ("Controller"). Our data protection officer is Frederic Wolens, who can be contacted at privacy@recordedfuture.com

We may process personal data relating to you that we have either obtained from you, or obtained from a third party including your previous or existing employers or reference agencies.  

Personal data we may collect from you:

-Your name and contact information (home address, home phone number, personal mobile number, personal email address).
-Your country of residence, citizenship, passport information and information relevant to your right of residence or right to work.
-Your date of birth.
-Your national insurance or social security details, or other similar information that is used by the government to identify you.
-Your gender.
-Your bank account information or other related financial details.
-Details of your education and previous employment history.
-Your driver's license and related information
-Your photograph.

We may process special categories of information relating to you. The processing of this information is strictly controlled by applicable law and will only be processed in limited circumstances, and may include:

Information relating to your physical characteristics, health or any disabilities, where this is relevant to your occupation or employment (for example, for the purposes of occupational health).

Information relating to your marital status, racial characteristics or sexual orientation where this is relevant to, for example, diversity monitoring.  This will normally only be processed with your consent in which case you are free to choose to provide this information, or not.

Your personal data will be processed for our legitimate interests for the purpose of managing our recruitment related activities, which include the setting up and conducting of interviews and tests for applicants, evaluating and assessing the results thereto and the selection of applicants for employment. As part of the recruitment and hiring processes we will need to process your personal data for the performance of a contract where we have offered you a position with our company.

Your personal data will be shared with Greenhouse Software, Inc., a cloud services provider located in the United States of America and engaged by us to help manage our recruitment and hiring process on our behalf. Accordingly, if you are located outside of the United States, your personal data will be transferred to the United States once you submit it through this site. Because the European Union Commission has determined that United States data privacy laws do not ensure an adequate level of protection for personal data collected from EU data subjects, the transfer will be subject to appropriate additional safeguards under the EU-US Privacy Shield.

Your personal data will be retained by us for as long as we decide that it is necessary to evaluate your application and determine whether to make you an offer of employment. After which it will be deleted or archived except to the extent that it is necessary for us to continue to process it for the purpose of compliance with legal obligations to which we are subject or for another legitimate and lawful purpose.

Under the GDPR, you have the right to request (i) access to your personal data, (ii) that your personal data be rectified or erased; and (iii) that processing of your personal data be restricted. You also have the right to data portability. In addition, you may lodge a complaint with your local supervisory authority. The Information Commissioner is the supervisory authority in the UK and can provide further information about your rights and our obligations in relation to your personal data.

Select...
Select...
Select...

If No, enter "N/A". If Yes please provide: (1) the name of the Mastercard or Recorded Future employee you have a close personal relationship with, and (2) the nature of that relationship.

Examples of close personal relationships include relatives (parent, grandparent, child, sibling, spouse, significant other, domestic partner, common law spouse, aunt/uncle, niece/nephew, cousin, in-law, and step/half relative); current or previous romantic or dating partners (no matter how casual); and any other relationship that is likely to or creates an actual or perceived conflict of interest or appearance of favoritism (for example, roommates and close friends). Close personal relationships would generally not include any former co-workers or managers with whom you do not regularly socialize outside of work.

 If No, enter "N/A." If Yes, please provide: (1) the name of the entity for which you will be performing the outside activity and the entity’s website, if available; (2) a description of what the entity does and the industry in which it operates; (3) a description of your role at the entity; and (4) the number of hours you will devote to the activity each month.

Examples of outside employment/activities include paid employment or other lawful money-making (cash or cash equivalent) activity that will not be part of your official role at Recorded Future; service on the board of directors or an advisory board of any entity (including non-profit), even if the position is unpaid; and service (paid or unpaid) in any national, state, provincial, regional, or local government, including any government department, ministry, agency, authority, commission, legislature, council, other public body (such as the World Bank or other public international organization), or state-owned enterprise.

If No, enter "N/A". If Yes, please describe the contract(s), the nature of your involvement, and list the name(s) of the involved Mastercard or Recorded Future employee(s). 

If No, enter "N/A". If Yes, please state the name of the individual, his/her employer and the nature of your relationship to this individual. If you answered "No", enter N/A

If Yes, please describe. If No, enter "N/A"

If yes, state the name of the individual, his/her employer and the nature of your relationship to this individual. If No, enter "N/A"

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiring process or thereafter. Any information that you do provide will be recorded and maintained in a confidential file.

As set forth in Recorded Future’s Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Select...
Select...
Race & Ethnicity Definitions

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection. As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measure the effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categories is as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305
Page 1 of 1
OMB Control Number 1250-0005
Expires 04/30/2026

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp.

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

  • Alcohol or other substance use disorder (not currently using drugs illegally)
  • Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
  • Blind or low vision
  • Cancer (past or present)
  • Cardiovascular or heart disease
  • Celiac disease
  • Cerebral palsy
  • Deaf or serious difficulty hearing
  • Diabetes
  • Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
  • Epilepsy or other seizure disorder
  • Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
  • Intellectual or developmental disability
  • Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
  • Missing limbs or partially missing limbs
  • Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
  • Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
  • Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
  • Partial or complete paralysis (any cause)
  • Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
  • Short stature (dwarfism)
  • Traumatic brain injury
Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.