{"id":2303824,"url":"https://alion.io/job/withsecure-threat-intelligence-reseacher","title":"Threat Intelligence Reseacher","company":{"id":56688,"name":"WithSecure","domain":"withsecure.com","url":"https://alion.io/company/withsecure","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jobylon","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Helsinki, Finland"],"countries":["FI"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":42000,"max_usd":101000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":629},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"Cyber Kill Chain","optional":true},{"name":"Diamond Model","optional":true},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-09-21T07:52:46Z","employer_posted_date":"2026-10-11","last_verified_at":"2026-10-13T15:15:48Z","board_verified":true,"closed_at":null,"days_open":22,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":22},"description":"At WithSecure™, we protect businesses all over the world. Our SaaS solutions safeguard against modern cyber threats, and our innovative Co-security approach reflects our belief that true protection requires collaboration and shared expertise. No one can solve every cyber security problem alone. Our vision is to become Europe’s flagship in cyber security. Every day, our talented teams work to prevent cyber extortion, secure critical infrastructure, and prevent misuse of sensitive data. At WithSecure, it’s our people who make us exceptional - a diverse community that values passion, purpose, and a commitment to workplace well-being. If you’re ready to make an impact with a company that’s transforming cybersecurity, we’d love to hear from you.\nWhat are we looking for?\nWe are looking for a Threat Intelligence Reseacher to join our Threat intelligence and response team and help improve our clients’ security posture and cyber resilience.\nThis is a hands-on specialist role focused on threat research, intelligence production, and translating complex threat activity into practical guidance. You will investigate threat actors, campaigns, intrusion techniques, malware, and significant cyber events, turning your findings into intelligence that customers and our internal teams can act on.\nYou will work directly with customers, presenting threat assessments and helping them understand how changes in the threat landscape relate to their industry, technology, and exposure. You will also develop and deliver internal training, strengthen our threat-intelligence capabilities, and share your expertise across the organization.\nThis is primarily a content and subject-matter-expert role. Customer communication is an important part of delivering that expertise, while account ownership and commercial relationship management remain with the relevant Customer Success and commercial teams.\nWhat You’ll Do\nResearch threat actors, campaigns, malware, adversary infrastructure, vulnerabilities, intrusion techniques, and significant cyber events.\nProduce sector threat landscapes, campaign assessments, threat-actor profiles, flash advisories, executive briefings, and technical intelligence reports.\nCombine intelligence from open sources, incident-response investigations, MDR observations, security telemetry, and other relevant sources.\nAssess which threats are genuinely relevant to customers based on their industry, geography, technology, and known exposure.\nTranslate technical findings into clear and actionable recommendations for security teams, CISOs, business leaders, and executive audiences.\nMap adversary activity to MITRE ATT&CK techniques, attack paths, indicators of compromise, and detection opportunities.\nSupport threat-led detection engineering by identifying emerging techniques, telemetry requirements, detection gaps, and opportunities for proactive threat hunting.\nWork closely with Incident Response, MDR, Exposure Management, Detection Engineering, and Consulting specialists.\nDeliver customer briefings, workshops, and threat-intelligence sessions.\nDesign and deliver internal training for consultants, analysts, Customer Success teams, and other relevant stakeholders.\nMaintain reusable intelligence content, research methodologies, and recommendation libraries.\nPeer-review intelligence products and help maintain a consistently high analytical standard.\nContribute to blog posts, research publications, webinars, and other thought-leadership activities.\nHow the Role Can Develop\nWe want this role to provide a genuine path towards deeper and more visible threat research.\nAs you demonstrate strong analytical quality, initiative, and customer impact, you can take increasing ownership of:\nConducting original research into threat actors, campaigns, malware, and emerging attacker techniques.\nAnalyzing our exposure management service\nLonger-term threat-research projects based on observations from our customer environments, MDR operations, and incident-response engagements.\nAuthoring detailed threat-intelligence reports and public research publications.\nDeveloping new research methods and shaping the direction of our threat-intelligence capability.\nRepresenting WithSecure through webinars, industry events, media briefings, and cyber security conferences.\nMentoring other analysts and helping develop the next generation of threat-intelligence specialists.\nConference presentations and public research would not be separate from the role-they would be a natural extension of high-quality work produced within it.\nWhat We’re Expecting From You\nAt least three years of relevant professional experience in threat intelligence, threat research, incident response, malware analysis, threat hunting, detection engineering, SOC, or MDR environments.\nDemonstrated experience investigating threat actors, campaigns, intrusion activity, or significant cyber events.\nThe ability to produce well-supported intelligence assessments rather than simply aggregate or summarize threat news.\nA solid understanding of attacker tradecraft, intrusion lifecycles, common malware capabilities, command-and-control infrastructure, and adversary techniques.\nExperience evaluating source reliability, distinguishing established facts from analytical judgments, and communicating confidence levels and intelligence gaps.\nThe ability to connect threat intelligence with customer-specific risk, exposure, and defensive priorities.\nStrong analytical writing skills and the ability to produce clear, concise, and defensible reports.\nConfidence presenting complex technical subjects to technical specialists, business leaders, and executive audiences.\nThe interpersonal skills to work directly with customers as a trusted subject-matter expert.\nThe ability and motivation to create training material, facilitate internal sessions, and mentor colleagues.\nIntellectual curiosity and the persistence required to investigate incomplete or conflicting information.\nProficiency in English.\nThe ability to work independently while actively collaborating and sharing knowledge with others.\nBeing an awesome colleague!\nBonus Points For\nExperience working with EDR, SIEM, MDR, threat-intelligence platforms, or large-scale security telemetry.\nPractical experience in incident investigation, threat hunting, or detection development.\nExperience with malware analysis, adversary infrastructure tracking, or advanced open-source intelligence techniques.\nFamiliarity with analytical frameworks such as MITRE ATT&CK, the Diamond Model, the Cyber Kill Chain, or structured analytical techniques.\nKnowledge of cloud, identity, SaaS, and hybrid-environment threats.\nExperience producing intelligence for industries such as finance, manufacturing, healthcare, energy, or the public sector.\nScripting or query-language skills that support research and analysis.\nPrevious experience publishing security research, writing technical reports, speaking at events, or contributing to the cyber security community.\nRelevant certifications such as GCTI, GCFA, GREM, CISSP, or equivalent practical expertise.\nUnderstanding of how threat intelligence supports NIS2, DORA, executive decision-making, and broader cyber-risk management.\nWhy You’ll Love Us\nMeaningful research: You will investigate real threat activity and turn your findings into intelligence that directly improves customer security.\nA path into original threat research: Strong performance can lead to ownership of research projects, authored reports, public publications, and conference presentations.\nFrontline insight: You will collaborate with specialists working in MDR, Incident Response, Exposure Management, Detection Engineering, and other security disciplines.\nDedicated research time: You will have time to investigate topics that matter, develop original findings, and collaborate with experienced researchers.\nSupport for visibility: We will support you in writing research reports, publishing blog posts, developing presentations, and speaking at relevant industry events.\nContinuous learning: We invest in relevant training, conferences, and certifications. You will also learn from colleagues through regular knowledge-sharing sessions.\nReal customer impact: Your intelligence will help customers understand who may target them, how those attacks could happen, and what they should prioritize.\nA top-notch team: You will work alongside experienced cyber security specialists who challenge one another, share their expertise, and continuously raise the bar.\nIf you enjoy uncovering the story behind cyber activity-and can turn that story into clear, defensible, and actionable intelligence-we would love to hear from you.\nReady to research the threats that matter and help customers prepare for them? Apply now and help us make the digital world safer.","description_format":"text","description_chars":8812,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Continuous learning"],"hiring_locations":[{"name":"Finland","iso":"FI","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Cloud Security","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-11T22:04:23Z"}],"visa":[],"liveness":{"score":58,"band":"ok","label":"Likely open","p_open":1,"p_active":0.768,"p_room":0.75,"age_days":21,"expected_fill_days":31,"reasons":["conf:1","win:late"],"computed_at":"2026-10-13T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/withsecure-threat-intelligence-reseacher","json_url":"https://alion.io/job/withsecure-threat-intelligence-reseacher.json","meta":{"generated_at":"2026-10-13T18:43:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28741,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":56688},"rest":"https://alion.io/mcp/rest/get_company?id=56688"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwithsecure-threat-intelligence-reseacher"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwithsecure-threat-intelligence-reseacher"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwithsecure-threat-intelligence-reseacher"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/withsecure-threat-intelligence-reseacher\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwithsecure-threat-intelligence-reseacher"}]}