Cyber Threat Intelligence Analyst

Nebius · Tel Aviv, Israel

// classified as

Other (Adjacent or hard to classify.)

> description

<div class="content-intro">About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D.</div><h3>The role</h3> As a Cyber Threat Intelligence (CTI) Analyst you will collect, analyze, and document cyber threat intelligence relevant to Nebius, its AI/Cloud infrastructure, employees, products, and brand, support security incident investigations, and provide verified, timely, and actionable findings that enable early detection of and response to emerging threats.  Your intelligence activities will be driven by Nebius Priority Intelligence Requirements and continuously adapted to the evolving threat landscape.  Your responsibilities will include:  <ul> <li>Collection: Run systematic searches based on Nebius Priority Intelligence Requirements across OSINT sources (Shodan/Censys, crt.sh, GitHub, VirusTotal/URLscan, Google dorks), commercial threat intelligence platforms, and Dark Web / Telegram monitoring. </li> <li>Intelligence Systems & Feeds: Receive and process alerts from the intelligence platforms the company is connected to, proactively query those systems (queries, pivoting), and cross-reference and validate findings against additional intelligence sources to reduce false positives, enrich alerts, and assess relevance to Nebius. </li> <li>Feed Consolidation: Aggregate, correlate, and consolidate cyber threat intelligence feeds and sources into a unified, actionable intelligence picture. </li> <li>Analysis: Identify spoofed/lookalike domains, brand impersonation, leaked credentials, infrastructure exposures, publicly exposed assets, and map threat actor TTPs to MITRE ATT&CK. </li> <li>Threat Impact Assessment: Analyze the likelihood that an emerging threat will affect the organization, identify weaknesses/exposures it could exploit, and assess the potential operational impact on Nebius. </li> <li>Incident Investigation: Support Provide intelligence support to the SOC / cybersecurity teams during security incidents: enrich observed IOCs, perform attribution to known threat actors where possible, supply context on expected TTPs, and monitor external sources for additional signals related to the incident. </li> <li>Threat Hunting Support: Support intelligence-driven hunt missions to augment detection capabilities and identify threats across the environment. </li> <li>Threat Actor Tracking: Document activity, campaigns, and TTPs of threat groups relevant to Cloud/AI infrastructure. </li> <li>IOC Management: Collect, validate, structure, defang, and prioritize indicators with source attribution and confidence levels. </li> <li>Watchlist Maintenance: Continuously update the search-term dictionary, monitored domains, brands, and intelligence watchlists used for threat monitoring. </li> <li>Documentation & Reporting: Write findings following the standard report format (BLUF, key findings, assessment, IOC feed, source coverage, and confidence level) as input to the Lead. </li> <li>Intelligence Hygiene: Log false positives separately (what was found, why dismissed), maintain proper TLP classification, and clearly distinguish verified facts from analytical assessment. </li> </ul> We expect you to have:  <ul> <li>Understanding of CTI methodology and the intelligence cycle. </li> <li>Hands-on familiarity with OSINT tools (Shodan, Censys, crt.sh, VirusTotal, etc.). </li> <li>Experience working with intelligence systems/platforms and handling an alert stream (triage), including consolidating multiple feeds. </li> <li>Experience validating intelligence across multiple independent sources. </li> <li>Understanding of the MITRE ATT&CK framework and TTP mapping. </li> <li>Ability to support incident investigations and hunt missions, working closely with the SOC in real time. </li> <li>Analytical capabilities of logical reasoning, critical thinking, and problem-solving. </li> <li>Critical analytical thinking – verifying findings across multiple sources, avoiding jumping to conclusions, and distinguishing fact from inference. </li> <li>Concise technical writing ability (BLUF, structured reports). </li> <li>Understanding of common attack techniques targeting Cloud infrastructure. </li> </ul> It will be an added bonus if you have:  <ul> <li>Experience with Cloud/AI infrastructure. </li> <li>Experience with Digital Risk Protection (DRP), external attack surface monitoring, or brand monitoring. </li> </ul><div class="content-conclusion">Benefits & Perks: <ul> <li>Competitive compensation</li> <li>Career growth and learning opportunities</li> <li>Flexibility and ownership</li> <li>Collaborative and innovative culture</li> <li>Opportunity to work on impactful AI projects</li> <li>International environment and talented teams</li> </ul> What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI  Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire.  If you need accommodations during the application process, please let us know.</div>