CTI Outbound Researcher

Every nation has data. Few can protect it. Fewer still can act on it.

Dream is the sovereign AI and national cyber-defense company for governments.

We help nations secure their most critical systems, connect fragmented information at a national scale, and turn their most sensitive data into decisions, all fully sovereign.

This is more than a job. It's a Dream job, where you'll work at a global scale alongside some of the best AI researchers, cyber operators, and government experts in the world.

We defend nations against the most advanced threats in the world with a national security suite that offers AI-native resilience against APTs with visibility, insights and mediation across Posture, CTI, and Detection & Response, all fully sovereign.

We are on an expedition to find you, a CTI Researcher who combines technical investigation with clear communication and strong relationships across the threat intelligence community. You will investigate threat actors, malicious infrastructure, and emerging campaigns; turn evidence into actionable intelligence; and help share Dream’s research through reports, briefings, publications, and industry events. You will work closely with Engineering, MLOps, Data, Product, Marketing, and Communications while maintaining analytical independence and evidence standards. 

• Conduct investigations into threat actors, adversary infrastructure, malware campaigns, vulnerabilities, and emerging activity. 
• Expand investigations from initial leads by analyzing relationships among domains, IP addresses, autonomous systems, certificates, passive DNS records, files, URLs, hosting providers, and registration data. 
• Form and test intelligence hypotheses, assess attribution, and distinguish confirmed evidence from analytical judgments and unresolved questions. 
• Identify, validate, prioritize, and track Indicators of Compromise (IOCs), then translate findings into detections, hunting opportunities, watchlists, and early-warning intelligence. 
• Write threat research reports, technical blogs, campaign analyses, executive briefs, and customer-facing publications for technical and non-technical audiences. 
• Build trusted relationships with researchers, security vendors, CERTs, CSIRTs, ISACs, academic teams, and other CTI partners; support intelligence sharing and joint research when appropriate. 
• Work with Marketing, PR, and Communications on publication launches, media materials, webinars, conference content, and external briefings without overstating the evidence. 
• Collaborate with Engineering, MLOps, Data, and Product teams on scalable intelligence capabilities while following sourcing, provenance, responsible-disclosure, legal, and data-quality requirements. 

• At least 3 years of hands-on experience in Cyber Threat Intelligence, adversary infrastructure research, malware or campaign analysis, incident-response intelligence, EASM, or a related field. 
• Strong understanding of DNS, passive DNS, IP addressing, ASNs, hosting and cloud providers, TLS/PKI, domain lifecycles, registration data, and phishing infrastructure. 
• Hands-on experience with commercial and open-source intelligence platforms such as VirusTotal, DNSDB, Censys, Shodan, SecurityTrails, MISP, or OpenCTI. 
• Working knowledge of STIX 2.1, MITRE ATT&CK, TAXII, the intelligence lifecycle, and structured analytical techniques. 
• Ability to investigate an initial indicator through infrastructure expansion, campaign assessment, confidence evaluation, and defensive recommendations. 
• Strong analytical writing and presentation skills, with the ability to explain technical findings, evidence limits, and uncertainty to researchers, customers, executives, and public audiences. 
• Interest in building professional relationships across the CTI community and working with external partners, PR teams, and communications teams. 
• Experience using Python, notebooks, or similar tools for enrichment, analysis, automation, and reproducible research; familiarity with Neo4j or Elasticsearch is a plus. 
• Published threat research, conference or webinar experience, and participation in intelligence-sharing communities are strong advantages. 

If you think this role doesn't fully match your skills but are eager to grow and break glass ceilings, we’d love to hear from you!