• Investigate and attribute activity across the crypto-services ecosystem, connecting on-chain activity to real-world entities. • Proactively surface what’s worth investigating — and the automation worth building. • Build and tune AI workflows that scale your analysis — and handle the edge cases automation can’t. • Drive the data collection and research that keep our attribution comprehensive and fresh. • Hold a high bar for accuracy, analytic rigor, and documentation. • Become a certified cryptocurrency professional across all Chainalysis certifications.

• Own attribution for the most complex, high-stakes parts of the ecosystem, and set the standard for how it’s done. • Design and lead the AI/automation that scales attribution across the team. • Shape collection strategy — what data we need and how we get it. • Mentor analysts and raise the team’s tradecraft. • Contribute analyses and insights that feed our products and customers. • Become a certified cryptocurrency professional across all Chainalysis certifications.

Role Description As a member of the Cybersecurity Team, you will be responsible for supporting the cyber threat intelligence program mission, architecture and operation. Successful execution of this program results in the delivery of crucial guidance to a variety of Wyndham teams across various disciplines. The key tenant of this position revolves around research on threat actors and campaigns targeting hotel chains, travel industry partner technologies, and the broader hospitality and retail sectors. The output of that research will be in the production of timely, actionable analysis and recommendations while remaining sensitive to changing business requirements from stakeholders. The individual selected for this role must have experience performing technical analysis of malware, phishing infrastructure, and attacker tooling to extract indicators, TTPs, and other potential attribution signals. This position will involve being deeply informed of commodity cybercrime threats, retail and hospitality specific fraud types, emerging vulnerabilities, and intimate knowledge of various malware families and threat actor tradecraft tooling. What you'll do - Perform regular threat intelligence research into cybercrime and nation state threat actor tradecraft and produce threat intelligence products and profiles based on defined intelligence requirements for selected stakeholders. Some of these products will be expected to be automated with human-review. - Support the planning and maintenance of tooling and automated pipelines to collect, enrich, correlate, and operationalize all-source intelligence into our detection and reporting stack. - Assist in the triage and review of security events by analyzing malicious artifacts gathered from forensic workflows using static and dynamic analysis techniques. - Apply knowledge of in-the-wild threats and TTPs to provide intelligence context for Security Operations and Detection Engineering personnel during triage and incident response operations. - Work alongside peers involved in Detection Engineering and Incident Response to translate intelligence into applicable detection rules, hunting hypotheses, red team and detection validation scenarios and inform incident context. - Build and maintain external intelligence-sharing relationships with peer organizations, RH-ISAC, and other select partners. Attend conferences, vendor Technical or Customer Advisory Boards and other industry events virtually or in-person. Qualifications - 3+ years of hands-on experience in cyber threat intelligence, threat hunting, intrusion analysis or incident response at an organization facing sophisticated cybercrime adversaries. - Not afraid to bring new ideas to the table and challenge the status quo. - A passion for cybersecurity, someone who enjoys reading industry news or listening to podcasts. - A strong engineering background, you have built computers, managed networks and maybe even coded a few tools yourself. - A strong foundation in network security, vulnerability exploitation concepts, and technical threat analysis. - Experience with Threat Intelligence Platforms (TIPs) and a working knowledge of technologies for intelligence integration. - Experience with leveraging the MITRE ATT&CK, MITRE D3FEND, CTI-CMM, Cyber Kill Chain, and other relevant security frameworks. - Demonstrate organized, focused research habits, know how to leverage various internet tools to find what you need to know. - Comfortable performing malware analysis, infrastructure analysis, OSINT, and log analysis to develop and validate findings. - Ability to break down complex and technical ideas for a non-technical audience. - Formal technical writing skills and personal experience producing finished deliverables for senior leadership. - Comfortable speaking in front of large audiences and leading calls. - Ability to multi-task and manage time is a must. - Have an existing network in the threat intelligence community and a track record of productive bidirectional sharing. Requirements - Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field preferred but not required. - Certifications (SANS, COMPTIA, ISC2 etc) preferred, not required. Benefits - Health insurance with HSA and FSA options - Dental insurance - Vision insurance - Life/AD&D insurance - Short- and Long-Term Disability coverage - 401(k) with generous company match - Vacation time - Accrue 1.615 hours of paid vacation per week - Paid holidays - 11 Core Scheduled Paid Holidays with potential additional paid days off - Paid sick leave accrued as state and local laws require - Additional paid time off in the form of one volunteer day, bereavement time, as well as jury duty time.

• Design, configure, maintain, and optimize operational intelligence collection pipelines supporting real-time monitoring and alerting workflows • Independently build, curate, tune, and manage structured datasets, collection logic, enrichment workflows, and operational intelligence pipelines • Develop and refine advanced collection strategies using Boolean logic, heuristics, metadata enrichment, tagging frameworks, geospatial filtering, and signal scoring methodologies • Drive continuous improvements in signal quality, workflow efficiency, operational relevance, and data reliability • Deploy, evaluate, monitor, and optimize AI/ML and computer vision models supporting operational intelligence workflows • Develop, test, and refine LLM-driven workflows, prompt frameworks, and AI-assisted alerting systems • Support multimodal intelligence workflows integrating text, image, video, metadata, geospatial, and behavioral signals into actionable operational insights • Partner closely with Product, Engineering, Data Science, Customer Success, and mission stakeholders to operationalize new capabilities and improve workflows • Lead operational troubleshooting, pipeline hardening, workflow optimization, and issue resolution efforts • Identify emerging collection opportunities, platform shifts, operational risks, and regional digital ecosystem changes • Contribute to operational standards, workflow documentation, and best practices for intelligence pipeline engineering • Mentor junior team members supporting operational intelligence workflows • Uphold classification, security, legal, and ethical standards for government-facing operational environments