Threat Operations Analyst

Threat & Vulnerability Analysis

• Review and analyse threats, risks, and vulnerabilities identified by CTRL and proactive detection pipelines
• Validate exposed services such as RDP, SSH, databases, and edge devices using Shodan, Censys, LeakIX, and Nuclei
• Evaluate security configurations to identify mitigating or compensating controls

Asset Verification & Attribution

• Confirm internet-facing asset ownership using WHOIS, DNS and reverse-DNS, TLS fingerprinting, Shodan data, and OSINT techniques
• Resolve attribution uncertainties to ensure customers receive notifications only for confirmed assets

Customer Notification & Advisory Work

• Produce clear security alerts outlining issues, affected assets, remediation guidance, and vendor references
• Communicate directly with customers and brokers to explain findings, clarify risk, and priorities remediation

Internal Collaboration & Escalation

• Act as a technical escalation point for Customer Support, Underwriting, and Claims
• Investigate queries related to exposed services, vulnerabilities, false positives, or disputed ownership
• Provide technical input to improve processes, detection workflows, and cross-team knowledge sharing

Operational Excellence

• Maintain a high standard of customer service with professional, timely communication
• Assist in tuning detection logic and improving vulnerability and exposure accuracy
• Support continuous improvement of CTRL intelligence capabilities and processes

Required Skills & Knowledge

• Strong understanding of networking fundamentals, ports, protocols, and common services
• Familiarity with cyber security concepts including CVE, CVSS, threat actor TTPs, exploitation lifecycle, and attack surfaces
• Hands-on experience with internet scanning and exposure tools such as Shodan, Censys, LeakIX, and Nuclei
• Ability to interpret DNS records, WHOIS data, HTTP headers, and OSINT artefacts
• Skilled at translating complex technical issues into clear, customer-friendly language