Senior Threat Intelligence Researcher, SentinelOne

• We’re looking for people who are relentlessly curious and committed to continuous learning
• Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes
• A Threat Intelligence / Threat hunting background
• Knowledge of the cyber threat landscape, including actors and TTPs
• Strong analytical skills, with the ability to identify patterns and trends in large datasets
• Programming skills in python and knowledge of databases (SQL, noSQL)
• Strong knowledge of YARA to track new malware families and knowledge on validation best practices
• Knowledge of MITRE ATT&CK, CISA KEV, EPSS, AMITT, MISP Galaxy

Desirable

• . AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts
• As a Senior Threat Intelligence Researcher, you'll lead deep-dive investigations into both emerging & known threats, while maintaining a vigilant watch over malware developments to ensure defenses remain a step ahead of evolving attack methods
• You'll put into use your ability to synthesize complex data into actionable intelligence, and to provide senior management with the clear briefings necessary to understand and mitigate potential risks
• Furthermore, you'll be expected to develop refined hunting strategies (to adapt to and anticipate shifts in threat actor tactics & techniques), and to track adversary infrastructure, effectively counteracting shifts in threat actor tactics through detail-oriented investigation
• Drive External Threat Research: Triage and evaluate findings from OSINT and lead in-depth investigations into emerging threats. Systematically evaluate signals from the global OSINT community and dark web forums to determine their fidelity, relevance, and impact
• Synthesize Actionable Intelligence: Transform raw data from dark web forums, leak sites, and research repositories into high-level threat briefings and risk assessments for senior stakeholders
• Adversary Knowledge Management: Curate and expand our internal Knowledge Base and IOCs collections
• Track Actor Tradecraft (TTPs): Monitor adversary behaviors across the open and deep web to identify shifts in recruitment, target selection and shifting of operations
• Pivot Across Infrastructure: Identify and map threat actor footprints by pivoting through domain registrations, SSL certificates, passive DNS
• Bridge Intelligence Gaps: Collaborate closely with Detection Engineering to translate validated OSINT findings into durable hunting logic
• Develop OSINT Tooling: Build and automate scrapers, monitors, and data-visualization tools to identify anomalies and track threats in external telemetry
• Working setup: Flexible working hours, this is a 100% remote role on full-time permanent employment based within Spain. We provide optional membership in major coworking chains