Threat Analyst (US)

About Netcraft  

 

Netcraft is the global leader in cybercrime detection and disruption. We’re a trusted partner for three of the four largest companies in the world and many large country governments. We’ve blocked more than 200 million malicious sites and perform takedowns for around one-third of the world’s phishing sites. 

Our purpose, passion, and expertise are focused on just one thing: protecting the world from cybercrime.  

Our passion doesn’t stop at what we do—it shapes how we work, too. We’re proud of our talented team and the value each person brings. That’s why we’ve created a workplace where people feel supported and inspired, from great benefits and wellness programs to fun social events.

 

The Role 

 

You will be focused on surfacing strategic and tactical insights to Netcraft’s customers through technical threat analysis of cyber-attacks including data leaks, criminal activity on underground forums, phishing, malicious JavaScript, scams and more. This position reports within the Product Strategy and Emerging Threats team, liaising closely with colleagues across multiple global teams. 

 

You must be based in the United States and be a United States citizen. This role offers the flexibility to work in our offices in Lehi, Utah or remotely within the United States. There will be an occasional need to travel domestically and internationally. 

 

This is what you’ll be doing, day to day: 

 

• Identifying potential cyber threats, determining levels of risk, and producing analytics and reports for a variety of customer audiences. 
  
• Conducting technical research and analysis using Netcraft’s threat intelligence platforms and data alongside open-source data and tools to assess threats, including reviews of technical attack data, source code and related metadata. This includes analysing the TTPs (tactics, techniques, and procedures) used by threat actors to carry out attacks.
• Serving as a technical liaison to Netcraft’s strategic customers, particularly in the North American market.
• Investigating and responding to RFIs and complex queries from customers about threats they are encountering, including mapping to and/or extending our existing knowledge.
• Monitoring and analysing the global threat landscape and industry trends related to cybercrime, emerging threats, and online fraud, including identifying ways in which threat actors may take advantage of global events.
• Preparing strategic and tactical assessments of current threats, themes and trends based on the collection, research, and analysis of Netcraft’s threat intelligence data.
• Collaborating with Netcraft’s operational and engineering teams to help enhance detection and mitigation of current and emerging threats.
• Assisting in production of technical whitepapers, customer insights, blog posts, and similar material to share with internal and external stakeholders on a regular basis. 

 

What you’ll need to be successful: 

 

• A strong foundation in open-source intelligence (OSINT), with experience identifying and analysing threat actor behaviours and sharing findings with diverse audiences.
• Extensive experience with deep and dark web intelligence, including monitoring underground forums and marketplaces to identify emerging risks. This may involve using tradecraft to engaging engage with online communities where users discuss and exchange information related to illicit or illegal activities, such as malware development, intrusion techniques, and cyber-attacks.
• A collaborative communication style, with the ability to translate technical findings into clear, actionable insights for both technical teams and senior leadership.
• Confidence working with data at scale using tools like SQL, spreadsheets, and command-line interfaces.
• Broad experience with cybersecurity threat hunting, dissecting online threats and source code review.
• A deep understanding of computer networks and internet technologies, including TCP/IP, DNS, HTTP, TLS, SMTP, JavaScript, Tor, and blockchain.
• Awareness of the broader internet infra