Cyber Threat Operations Architect

About the role

We are looking for a seasoned Cyber Threat Operations Architect to lead and grow our Threat Operations team. You will be responsible for ensuring high‑quality technical output, managing daily workflows, and acting as the primary liaison with customers and internal stakeholders on complex security incidents.

Key responsibilities

• Lead, mentor, and develop Threat Operations Analysts to maintain strong technical performance and output quality.
• Manage daily workflows, case allocation, and SLA adherence.
• Review analyst findings, advisories, and attribution assessments for quality and accuracy.
• Support hiring, onboarding, training, and professional development of the team.
• Ensure accurate, consistent, and timely threat and vulnerability notifications.
• Monitor metrics, case volumes, detection triggers, and workload distribution.
• Improve processes, documentation, and internal playbooks.
• Coordinate with the CTRL team on new detection patterns, use cases, and scanning methods.
• Oversee outbound advisories to meet client communication standards.
• Engage with brokers or customers on complex technical cases.
• Represent Cyber Operations in internal reviews and cross‑functional initiatives.

Required profile

• Strong understanding of networking fundamentals and internet‑facing services.
• Solid knowledge of vulnerabilities, CVE/CVSS scoring, adversary behavior, and exploitation techniques.
• Experience with exposure tools and datasets such as Shodan, Censys, LeakIX, Nuclei, DNS, and WHOIS.
• Ability to validate complex attribution and mitigation scenarios.
• Excellent customer‑facing technical communication skills.

Required skills

• Networking fundamentals
• Internet‑facing services
• Vulnerability analysis
• CVE/CVSS scoring
• Adversary behavior analysis
• Exploitation techniques
• Shodan
• Censys
• LeakIX
• Nuclei
• DNS
• WHOIS