• Identify and prioritize exposure risk across endpoints and identity systems. • Convert endpoint/identity signals into exploitability-aware exposure intelligence. • Produce clear remediation plans; support validation and closure tracking. • Partner with IAM/endpoint teams to implement durable corrective actions.

• Help secure modern cloud environments by identifying exploitable misconfigurations and attack paths across AWS, Azure, and GCP. • Create prioritization and remediation guidance; track closure outcomes. • Own SME coverage for cloud exposure: IAM misconfigurations, excessive privileges, insecure storage, network exposure, workload security, and posture drift. • Partner with cloud platform teams to validate fixes and reduce repeated exposure creation.

Role Description Provide timely and actionable intelligence to support customer intelligence requirements. - Leverage global datasets (e.g., netflow, malware, passive DNS, geospatial intelligence) to track malicious cyber actors, their infrastructure, and campaigns. - Proactively collaborate and exchange information with a global team of threat intelligence analysts to analyze and develop coverage for emerging threats. - Develop and present strategic threat assessments tailored to customer needs and intelligence gaps. - Communicate effectively with product engineering teams to improve detection efficacy in our ecosystem of products. - Challenge existing assumptions by curiously investigating threat actor TTPs to produce unique and predictive intelligence. - Simplify complex technical findings into clear, concise reports for a variety of audiences. Qualifications - Experience with large-scale data analysis platforms, such as BigQuery. - Familiarity with static and dynamic malware analysis using common industry tools (e.g., IDA Pro, Ghidra, x64dbg). - Deep knowledge of the MITRE ATT&CK Matrix and its application in tracking threat actor behaviors. - Experience working within a security operations center (SOC), fusion center, or incident management team. - Outstanding verbal and written communication skills, with experience delivering presentations to technical and executive audiences. Requirements - The compensation offered for this position will depend on qualifications, experience, and work location. - For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary + commission target (for sales/commissioned roles) is expected to be the annual range listed below: $139,600.00 - $225,775.00/yr. - The offered compensation may also include restricted stock units and a bonus. Benefits - We’re trailblazers that dream big, take risks, and challenge cybersecurity’s status quo. - We are committed to providing reasonable accommodations for all qualified individuals with a disability. - Palo Alto Networks is an equal opportunity employer. - All your information will be kept confidential according to EEO guidelines.

• Collect, pivot, and analyze multi-source telemetry—including OSINT, commercial feeds, deep/dark web forums, and internal technical logs—to profile threat actors, track localized and global cyber campaigns, and map adversary TTPs directly to the MITRE ATT&CK framework. • Manage, tune, and optimize the Threat Intelligence Platform (TIP) to ingest, score, and deduplicate IOCs, collaborating with SIEM/SOAR and Detection Engineering teams to translate threat trends into actionable YARA, Sigma, and SIEM rules. • Partner with security teams to design and execute hypothesis-based threat hunting scopes and conduct retroactive hunts across data lakes and internal security platforms utilizing newly identified indicators and zero-day vulnerability intelligence. • Provide real-time, context-driven intelligence support during active security incidents, delivering critical briefings on attacker infrastructure, capabilities, and intent to the Incident Response (IR), SOC, and DevSecOps teams. • Synthesize complex, abstract technical data into high-impact threat assessments, flash reports, and threat actor profiles ("baseball cards"), contextualizing technical risks into actionable operational insights for both technical stakeholders and executive leadership.