Role Description As a member of the Cybersecurity Team, you will be responsible for supporting the cyber threat intelligence program mission, architecture and operation. Successful execution of this program results in the delivery of crucial guidance to a variety of Wyndham teams across various disciplines. The key tenant of this position revolves around research on threat actors and campaigns targeting hotel chains, travel industry partner technologies, and the broader hospitality and retail sectors. The output of that research will be in the production of timely, actionable analysis and recommendations while remaining sensitive to changing business requirements from stakeholders. The individual selected for this role must have experience performing technical analysis of malware, phishing infrastructure, and attacker tooling to extract indicators, TTPs, and other potential attribution signals. This position will involve being deeply informed of commodity cybercrime threats, retail and hospitality specific fraud types, emerging vulnerabilities, and intimate knowledge of various malware families and threat actor tradecraft tooling. What you'll do - Perform regular threat intelligence research into cybercrime and nation state threat actor tradecraft and produce threat intelligence products and profiles based on defined intelligence requirements for selected stakeholders. Some of these products will be expected to be automated with human-review. - Support the planning and maintenance of tooling and automated pipelines to collect, enrich, correlate, and operationalize all-source intelligence into our detection and reporting stack. - Assist in the triage and review of security events by analyzing malicious artifacts gathered from forensic workflows using static and dynamic analysis techniques. - Apply knowledge of in-the-wild threats and TTPs to provide intelligence context for Security Operations and Detection Engineering personnel during triage and incident response operations. - Work alongside peers involved in Detection Engineering and Incident Response to translate intelligence into applicable detection rules, hunting hypotheses, red team and detection validation scenarios and inform incident context. - Build and maintain external intelligence-sharing relationships with peer organizations, RH-ISAC, and other select partners. Attend conferences, vendor Technical or Customer Advisory Boards and other industry events virtually or in-person. Qualifications - 3+ years of hands-on experience in cyber threat intelligence, threat hunting, intrusion analysis or incident response at an organization facing sophisticated cybercrime adversaries. - Not afraid to bring new ideas to the table and challenge the status quo. - A passion for cybersecurity, someone who enjoys reading industry news or listening to podcasts. - A strong engineering background, you have built computers, managed networks and maybe even coded a few tools yourself. - A strong foundation in network security, vulnerability exploitation concepts, and technical threat analysis. - Experience with Threat Intelligence Platforms (TIPs) and a working knowledge of technologies for intelligence integration. - Experience with leveraging the MITRE ATT&CK, MITRE D3FEND, CTI-CMM, Cyber Kill Chain, and other relevant security frameworks. - Demonstrate organized, focused research habits, know how to leverage various internet tools to find what you need to know. - Comfortable performing malware analysis, infrastructure analysis, OSINT, and log analysis to develop and validate findings. - Ability to break down complex and technical ideas for a non-technical audience. - Formal technical writing skills and personal experience producing finished deliverables for senior leadership. - Comfortable speaking in front of large audiences and leading calls. - Ability to multi-task and manage time is a must. - Have an existing network in the threat intelligence community and a track record of productive bidirectional sharing. Requirements - Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field preferred but not required. - Certifications (SANS, COMPTIA, ISC2 etc) preferred, not required. Benefits - Health insurance with HSA and FSA options - Dental insurance - Vision insurance - Life/AD&D insurance - Short- and Long-Term Disability coverage - 401(k) with generous company match - Vacation time - Accrue 1.615 hours of paid vacation per week - Paid holidays - 11 Core Scheduled Paid Holidays with potential additional paid days off - Paid sick leave accrued as state and local laws require - Additional paid time off in the form of one volunteer day, bereavement time, as well as jury duty time.

• Design, configure, maintain, and optimize operational intelligence collection pipelines supporting real-time monitoring and alerting workflows • Independently build, curate, tune, and manage structured datasets, collection logic, enrichment workflows, and operational intelligence pipelines • Develop and refine advanced collection strategies using Boolean logic, heuristics, metadata enrichment, tagging frameworks, geospatial filtering, and signal scoring methodologies • Drive continuous improvements in signal quality, workflow efficiency, operational relevance, and data reliability • Deploy, evaluate, monitor, and optimize AI/ML and computer vision models supporting operational intelligence workflows • Develop, test, and refine LLM-driven workflows, prompt frameworks, and AI-assisted alerting systems • Support multimodal intelligence workflows integrating text, image, video, metadata, geospatial, and behavioral signals into actionable operational insights • Partner closely with Product, Engineering, Data Science, Customer Success, and mission stakeholders to operationalize new capabilities and improve workflows • Lead operational troubleshooting, pipeline hardening, workflow optimization, and issue resolution efforts • Identify emerging collection opportunities, platform shifts, operational risks, and regional digital ecosystem changes • Contribute to operational standards, workflow documentation, and best practices for intelligence pipeline engineering • Mentor junior team members supporting operational intelligence workflows • Uphold classification, security, legal, and ethical standards for government-facing operational environments

• As the Principal for Competitive Intelligence within the Cortex Product Management organization, you are the strategic link between the competitive landscape and our product roadmap. • By applying Structured Analytic Techniques (SATs) to technical competitive data, you will provide the "Inconvenient Truths" that challenge our product assumptions. • You will be responsible for ensuring that Cortex doesn't just match competitor features, but maintains a structural architectural advantage that is validated by evidence and field reality. • You will translate deep research results into Product Requirement Documents (PRDs), prioritize feature gaps based on competitive urgency, and present key takeaways to senior leaders. • Go beyond CRM data to conduct "post-mortem analysis" deep dives on significant losses, delivering actionable product feedback to Engineering and PM leadership to remove technical friction in the sales cycle.

• Design and execute structured evaluation frameworks to assess the quality, coverage, and fraud-signal value of incoming data assets from vendor partners • Build lift analyses, backtests, and champion/challenger comparisons to quantify the incremental value of new data signals against our existing fraud detection stack • Profile vendor datasets for completeness, freshness, match rates, and population coverage across verticals (crypto, fintech, neobanks, e-commerce, etc.) • Collaborate with fraud leadership to define evaluation criteria tied to real fraud outcomes — false positive rates, catch rates, precision/recall tradeoffs • Translate vendor data findings into clear, actionable recommendations: adopt, pilot, deprioritize, or decline • Partner with data engineering to define ingestion requirements and ensure test environments reflect production-like conditions • Document evaluation results and maintain an internal knowledge base on vendor data performance over time • Support ad hoc deep dives into fraud trends, model performance, and client-specific data questions as needed