דרושים » אבטחת מידע וסייבר » Threat Intelligence Researcher

Check Point Research is expanding and establishing a new international force of talented Researchers. We are looking for a Malware Analysis Team Leader with a deep focus on cybercrime investigations to lead a dynamic team of experts dedicated to identifying, analyzing, publishing, and mitigating cybercrime-related threats. This leadership role will drive advanced malware analysis efforts, conduct threat research, publish in top conferences and blogs, and coordinate with internal and external stakeholders to combat and prevent cybercriminal activities. The ideal candidate will have strong technical expertise in malware reverse engineering, a deep understanding of cybercrime tactics, and excellent communication skills, including the ability to present findings clearly and publish research for internal stakeholders and the broader cybersecurity community.

The work of our researchers is constantly presented at international conferences and covered by major media outlets globally. Threat research is an exciting area for us, and we give the CP members the freedom and means to practice it.

Key Responsibilities
Lead the Malware Analysis Team: Manage and mentor a team of skilled researchers on identifying, analyzing, and mitigating malware associated with cybercrime, including ransomware, banking Trojans, exploit kits, and other forms of cybercriminal malware.
Cybercrime Threat Intelligence: Collaborate with threat intelligence teams to analyze malware in the context of cybercrime syndicates and criminal activity. Identify trends, tactics, and patterns in malware usage by cybercriminal groups and provide actionable intelligence to relevant teams and external partners.
Malware Reverse Engineering: Lead efforts in reverse-engineering malicious software, tracking variants, and identifying attack techniques, tactics, and procedures (TTPs) cybercriminal actors use.
Cross-Functional Collaboration: Work closely with internal teams (e.g., Incident Response, Threat Intelligence, SOC) and external stakeholders (e.g., law enforcement, CERT, threat intelligence providers) to share findings, collaborate on investigations and coordinate actions to disrupt cybercrime activities.
Publication and Thought Leadership: Produce detailed, high-quality research reports and technical papers based on malware analysis and cybercrime investigations. Contribute to the publication of findings in industry-leading forums, conferences, and journals, establishing the organization as a thought leader in cybersecurity.
Presentations and Reporting: Prepare and deliver presentations to technical and non-technical stakeholders, including executives, legal teams, and law enforcement. Communicate complex findings, research insights, and actionable intelligence on cybercrime and malware trends.
Training and Development: Mentored junior team members, providing guidance on malware analysis techniques, threat hunting, and reporting. Foster a culture of continuous improvement, encouraging knowledge sharing and professional development within the team.
Stay Informed on Emerging Threats: Regularly monitor and research new and evolving cybercrime tactics, malware trends, and global threat intelligence. Leverage this knowledge to enhance the organization's defense posture and share updates with relevant stakeholders.

Requirements:
5+ years of experience in malware analysis, cybercrime investigations, or related fields.
2+ years in a leadership or team management role with experience leading cybersecurity operations in high-stakes environments.
Expertise in malware reverse engineering (static and dynamic analysis).
Proficiency in using industry-standard tools such as IDA Pro, X64, VT, Etc.
Strong understanding of common malware types used in cybercrime (e.g., ransomware, keyloggers, exploit kits, mobile threats).
Development skills with Python, C/C++, Assembly, or other scripting languages for malware analysis and automation.

.המשרה מיועדת לנשים ולגברים כאחד

Were looking for a hands-on incident response expert thats passionate about investigating real threats, building scalable detections, and improving automation across modern cloud-native environments. This is a high-impact role within our security group, ideal for someone who thrives on both investigation and building long-term solutions. In your day-to-day, youll:

Investigate complex security incidents in cloud (AWS/GCP), containerized (Kubernetes), and endpoint environments

Design and maintain detection rules and anomaly-based logic to identify emerging threats in production systems

Automate forensic evidence collection and response actions across diverse platforms and services

Collaborate with SOC analysts, Security Architects, and Engineering teams to improve detection coverage and data visibility

Lead incident retrospectives and document technical findings, response steps, and process improvements

Develop and maintain investigation playbooks, chain-of-custody protocols, and sprint-based IR deliverables

Participate in on-call rotations and contribute to incident readiness exercises and escalation protocols

As a Security Infra Engineer, youll design, build, and manage security aspects of our cloud-based and physical environments to ensure compliance and integrity. In your day-to-day, you will:

Design, implement, and maintain platforms for investigating and analyzing security incidents, performing root cause analysis, and coordinating remediation efforts

Design, implement, and maintain security tools and controls for cloud-based infrastructure, Kubernetes clusters, and services, ensuring compliance with industry standards

Build tools and scripts using Golang, Python, or Node.js

Collaborate with all infrastructure groups (cloud, networking, DB, DevEx, etc.) and the Chief Information Security Officer group (for example, for incident response)

Align with other infrastructure standards, including efficiency, reliability, and cost

Work closely with cross-functional teams to design, implement, maintain, and manage security solutions that ensure the integrity and confidentiality of our systems