Threat Intelligence Security Analyst

at  GITHUB INC

About GitHub: As the global home for all developers, GitHub is the complete AI-powered developer platform to build, scale, and deliver secure software. Over 100 million people, including developers from 90 of the Fortune 100 companies, use GitHub to build amazing things together across 330+ million repositories. With all the collaborative features of GitHub, it has never been easier for individuals and teams to write faster, better code.
Locations: In this role you can work from Remote, United Kingdom
Overview:
GitHub is looking for a threat intelligence analyst to protect GitHub from advanced cyber threats.
If you have experience conducting technical and open source threat intelligence investigations, strong written and verbal communication skills, and are comfortable working on multiple projects to solve complex security problems, we want to hear from you!
About the Role
GitHub’s Threat Intelligence team uses data from a variety of open, closed and internal sources to gain insight into adversary activity and drive intelligence-informed security countermeasures across GitHub.
We are looking for an analyst to join our growing threat intelligence team. This role will focus on researching and operationalizing high-quality threat intelligence – helping the team drive secure outcomes across GitHub products and infrastructure.

Responsibilities:

• Develop and maintain subject matter expertise in a portfolio of threats to GitHub, our customers, employees, infrastructure and the wider open source community from all available sources.
• Provide actionable information by producing appropriate, relevant and concise analysis for stakeholders including teams within Engineering, Security and executive leadership.
• Provide analytic support to GitHub security teams.
• Build and maintain strategic partnerships with internal and external teams to better understand and track threats to GitHub and our customers.
• Evaluate the risks of emerging threats, such as influence and cyber-enabled influence operations.
• Contribute to the development and maintenance of automation tools to assist in investigations.
• Coordinate disruption efforts against sophisticated misuse of the GitHub platform by advanced threat actors.
• Present sanitized intelligence to broad internal audiences to improve security awareness across the company.

Qualifications:

Required Qualifications:

• Cyber threat intelligence analysis or investigations experience with a focus on tracking and disrupting persistent adversaries
• Strong knowledge of the cyber threat landscape, including trends in nation-state and cybercrime threat actor infrastructure, attack vectors, tooling, and tactics, coupled with strong evidence handling and documentation skills.
• Coding or scripting experience with Python and/or other programming languages
• Excellent technical foundation, including a sound understanding of security fundamentals, networking, vulnerability management, cryptography, supply-chain risks, and modern identity and access management technologies

Preferred Qualifications:

• Exceptional written and verbal communication skills
• Proficient with Pandas and Jupyter notebooks, and query languages such as SQL, Splunk and KQL
• Knowledge of open source intelligence tools and methods
• Experience building tools and automations in collaborative codebases, including leveraging tools like git and GitHub
• Knowledge of Linux and MacOS command line tools
• Experience with account takeover, scams/fraud, malware distribution, and ransomware investigations
• Ability to prioritize tasks in a fast-paced environment, handle sensitive information securely, and work autonomously in a global, distributed organizational setting

GitHub Leadership Principles:

• Develop and maintain subject matter expertise in a portfolio of threats to GitHub, our customers, employees, infrastructure and the wider open source community from all available sources.
• Provide actionable information by producing appropriate, relevant and concise analysis for stakeholders including teams within Engineering, Security and executive leadership.
• Provide analytic support to GitHub security teams.
• Build and maintain strategic partnerships with internal and external teams to better understand and track threats to GitHub and our customers.
• Evaluate the risks of emerging threats, such as influence and cyber-enabled influence operations.
• Contribute to the development and maintenance of automation tools to assist in investigations.
• Coordinate disruption efforts against sophisticated misuse of the GitHub platform by advanced threat actors.
• Present sanitized intelligence to broad internal audiences to improve security awareness across the company