Discovering and analyzing attacker activity across on-premises and cloud environments. Identifying potential threats, allowing for proactive defense and customer notification before an actual incident. Providing recommendations to improve customers' cybersecurity posture going forward and performing threat intelligence knowledge transfer to prepare customers to defend against today's threat landscape. Building proof-of-concept and prototype threat hunting tools, automations, and new capabilities. Driving product and tooling improvements by conveying learnings from threat intelligence and intrusion analysis at scale to engineering partner teams. Using large-scale query workflows to distill adversary signal within an unparalleled volume of suspicious activity to pivot, validate, and scope what matters. Doctorate in Computer Science, Cybersecurity, Intelligence Analysis, Mathematics, National Security Studies, or related field AND 3+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR Master's Degree in Computer Science, Cybersecurity, Intelligence Analysis, Mathematics, National Security Studies, or related field AND 4+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR Bachelor's Degree in Computer Science, Cybersecurity, Intelligence Analysis, Mathematics, National Security Studies, or related field AND 6+ years experience in software development lifecycle, large-scale computing, threat analysis or modeling, cybersecurity, vulnerability research, and/or anomaly detection OR equivalent experience. Understanding of malware, tooling, and related activity well enough to extract indicators and develop detections for attacker methods. Reverse engineering or detection engineering depth is a plus, not a requirement. Curiosity and ingenuity matter as much as years of technical experience. Experience producing strategic, operational, and tactical threat intelligence, including actor tracking, campaign clustering, and analytic writing for technical and executive audiences. Familiarity and understanding of SQL or Kusto Query Language (KQL) queries (or experience with large database/SIEM query languages such as Splunk/Humio/Kibana, etc.) Deep knowledge of endpoint, email, and cloud forensic log artifacts - or similar experience in analysis of SIEM logs, web server logs, AV logs, and security logs. Experience building and reviewing threat hunting automations using scripting languages. Experience developing collection requirements, judging source reliability, and turning raw telemetry and partner reporting into actionable assessments. Demonstrated advanced problem solving, troubleshooting, and analysis skills.