Senior Threat Operations Analyst

About the role

The Senior Threat Operations Analyst is responsible for identifying, validating, and communicating internet‑facing security risks to customers. This role combines deep technical analysis with clear, customer‑focused communication.

Key responsibilities

• Review and analyse threats, risks, and vulnerabilities from CTRL and proactive detection pipelines.
• Validate exposed services (RDP, SSH, databases, edge devices) using tools such as Shodan, Censys, LeakIX and Nuclei.
• Verify ownership of internet‑facing assets through WHOIS, DNS, TLS fingerprinting and OSINT techniques.
• Prepare concise security alerts, remediation recommendations and vendor references for customers and brokers.
• Act as a technical escalation point for Support, Underwriting and Claims teams, improving detection workflows and operational processes.

Required profile

• Strong analytical and investigative skills with the ability to distinguish genuine risks from false positives.
• Excellent written and verbal communication, capable of translating complex technical findings for both technical and non‑technical audiences.
• Solid understanding of networking fundamentals, CVE/CVSS, threat actor TTPs and the exploitation lifecycle.

Required skills

• Hands‑on experience with Shodan, Censys, LeakIX and Nuclei for asset discovery.
• Ability to interpret DNS records, WHOIS data, HTTP headers and TLS certificates.
• Proficiency in OSINT techniques for asset attribution.
• Knowledge of networking fundamentals (ports, protocols, common services).
• Familiarity with CVE, CVSS scoring and threat actor tactics, techniques and procedures.