Job Description

• Location: Spain
• Work model: Remote, with occasional on-site presence in Madrid.

Mission

Analyze and classify malicious domains blocked by a network-level cybersecurity solution. You’ll identify threat type, intent, and behavior, and help transform this analysis into automated insights used in dashboards, reports and threat intelligence

You’ll work independently on investigations while collaborating closely with Data & BI teams to scale your findings.

What You’ll Do

• Analyze blocked domains and URLs to identify threats (phishing, malware delivery, scams, adware, C2, fraud, crypto scams)
• Investigate threats using VirusTotal (API/Enterprise) and other TI sources
• Correlate domains, IPs, URLs, and detections to identify campaigns and patterns
• Define and maintain threat classification rules with data engineers
• Validate automated classifications through manual sampling and deep dives
• Contribute to dashboards and reports showing threat trends and protection value
• Document findings clearly and consistently

Requirements

Requirements

• 2–4 years of experience in threat intelligence, web threat research, or domain/URL analysis
• Strong understanding of common web threats and attacker techniques
• Hands-on experience with VirusTotal (API/Enterprise), Python-based investigation is a plus
• Working knowledge of DNS, HTTP/HTTPS, SSL/TLS, and web content behavior
• Comfortable working with large datasets and analytical outputs
• Ability to work independently and collaborate with data and engineering teams
• Clear communication skills, able to explain findings to technical and non-technical audiences
• Fluent in English and Spanish