Sr. Analyst, Cyber Threat Intelligence

Why Wyndham?

By joining Wyndham Hotels & Resorts, you will play an integral role in our mission to make hotel travel possible for all. You’ll be part of one of the largest hotel franchise companies in the world, where we strive to deliver the best value to our owners and guests. Most importantly, you’ll be entrusted to live our unique Count on Me culture, set by our core values of integrity, accountability, inclusive, caring and fun. At Wyndham, we provide all team members the opportunity to grow through best-in-class training and career development, leadership training, mentorship opportunities and educational support.  Supporting our team members is a top priority, which is why we offer competitive compensation and benefits, vacation, team member appreciation days, workplace flexibility and much more.  At Wyndham Hotels & Resorts, we value and embrace a culture of diversity, equity and inclusion that supports team members of all backgrounds and experiences. We can’t wait to welcome you!

The Role

As a member of the Cybersecurity Team, you will be responsible for supporting the cyber threat intelligence program mission, architecture and operation. Successful execution of this program results in the delivery of crucial guidance to a variety of Wyndham teams across various disciplines. The key tenant of this position revolves around research on threat actors and campaigns targeting hotel chains, travel industry partner technologies, and the broader hospitality and retail sectors. The output of that research will be in the production of timely, actionable analysis and recommendations while remaining sensitive to changing business requirements from stakeholders.

The individual selected for this role must have experience performing technical analysis of malware, phishing infrastructure, and attacker tooling to extract indicators, TTPs, and other potential attribution signals. This position will involve being deeply informed of commodity cybercrime threats, retail and hospitality specific fraud types, emerging vulnerabilities, and intimate knowledge of various malware families and threat actor tradecraft tooling.

What you'll do

• Perform regular threat intelligence research into cybercrime and nation state threat actor tradecraft and produce threat intelligence products and profiles based on defined intelligence Requirements for selected stakeholders. Some of these products will be expected to be automated with human-review. 
• You will support the planning and maintenance of tooling and automated pipelines to collect, enrich, correlate, and operationalize all-source intelligence into our detection and reporting stack.
• You will be expected to assist in the triage and review of security events by analyzing malicious artifacts gathered from forensic workflows using static and dynamic analysis techniques. You will also apply your knowledge of in-the-wild threats and TTPs to provide intelligence context for Security Operations and Detection Engineering personnel during triage and incident response operations. 
• Work alongside peers involved in Detection Engineering and Incident Response to translate intelligence into applicable detection rules, hunting hypotheses, red team and detection validation scenarios and inform incident context. 
• Build and maintain external intelligence-sharing relationships with peer organizations, RH-ISAC, and other select partners. Attend conferences, vendor Technical or Customer Advisory Boards and other industry events virtually or in-person. 

You'll be successful if you have

• 3+ years of hands-on experience in cyber threat intelligence, threat hunting, intrusion analysis or incident response at an organization facing sophisticated cybercrime adversaries.
• Are not afraid to bring new ideas to the table and challenge the status quo. 
• A passion for cybersecurity, someone who enjoys reading industry news or listening to podcasts. 
• A strong engineering background, you have built computers, managed networks and maybe even coded a few tools yourself, you don't need to hand requirements to someone else to get something built.
• A strong foundation in network security, vulnerability exploitation concepts, and technical threat analysis.
• Experience with Threat Intelligence Platforms (TIPs) and a working knowledge of technologies for intelligence integration, including their use within a modern Security Operations Center architecture. 
• Experience with leveraging the MITRE ATT&CK, MITRE D3FEND, CTI-CMM, Cyber Kill Chain, and other relevant security frameworks and applying them to processes and procedures.
• Demonstrate organized, focused research habits, know how to leverage various internet tools to find what you need to know, including leveraging AI-assistance. 
• Are comfortable performing malware analysis, infrastructure analysis, OSINT, and log analysis to develop and validate your own findings.
• Ability to break down complex and technical ideas for a non-technical audience.
• Formal technical writing skills and personal experience producing finished deliverables for senior leadership which resulted in action.
• Comfortable speaking in front of large audiences and leading calls.  
• Ability to multi-task and manage time is a must. 
• Have an existing network in the threat intelligence community and a track record of productive bidirectional sharing.

Required Qualifications/Experience

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field preferred but not required.
• Certifications (SANS, COMPTIA, ISC2 etc) preferred, not required.