Threat Researcher

About the Role

Abnormal AI is looking for a Threat Researcher to join our Threat Intelligence team.

This is an analyst role for someone who is equally interested in understanding threats and figuring out how to make intelligence useful.

You will conduct original research into active campaigns, attacker behavior, and emerging email and identity attack techniques. You will also draw on research and data produced by other parts of the Threat Intelligence organization. Your job is to connect those inputs, determine what is meaningful, and turn them into the right intelligence product for the audience and objective.

That might mean a concise threat brief for a security practitioner, a deeper analytical report, tailored intelligence content for Customer Success to use in a customer QBR, a briefing for a prospect, a webinar for a broader audience, or content supporting a high-priority sales pursuit.

The defining skill for this role is intelligence synthesis: combining technical research, data, threat context, and audience needs into a clear assessment and compelling narrative.

You will work closely with Threat Intelligence, Detection, Sales, Customer Success, and Marketing teams. You will also interact directly with customers and prospects, bringing intelligence to life through briefings, presentations, webinars, and tailored content.

Success in this role is not measured by how many documents you produce. It is measured by whether you can identify the important intelligence, explain what it means, and put it in a form that helps the audience understand and act on it.

What You Will Do

Analyze & Research

Independently scope and lead complex or ambiguous threat intelligence investigations into active campaigns, attacker behavior, TTPs, and emerging email and identity attack techniques. Determine appropriate research approaches, evaluate incomplete or conflicting evidence, and develop defensible intelligence assessments with limited direction.

Use Abnormal's platform, internal telemetry and data, threat intelligence sources, and external research to investigate threats and develop intelligence assessments.

Identify meaningful patterns, connections, and emerging trends across threat activity.

Develop a strong understanding of how Abnormal detects and responds to the threats you analyze.

Synthesize Intelligence

Independently synthesize complex and sometimes conflicting intelligence from disparate sources, determine the most consequential insights, and develop defensible assessments and recommendations tailored to the audience and decision at hand.

Determine what is most relevant to a particular audience, customer situation, or business objective.

Translate raw findings into insight, implications, recommendations, and a clear narrative.

Adapt the depth, framing, terminology, and format of intelligence based on the audience.

Connect technical threat activity to business risk and explain why it matters.

Create Intelligence Products

Produce a range of intelligence deliverables, including:

Threat briefs

Analytical reports