Threat Modeling Analyst

Role Summary

The L2 Threat Hunting & Threat Modeling Analyst is responsible for executing standard and custom threat hunts, supporting threat intelligence integration for hunting, and conducting application/project threat modeling assessments using automated tooling (e.g., ThreatModeler).

This role handles activities escalated from L1/SOC teams, performs deeper analysis, produces technical reports, and coordinates with L3 SMEs for complex hunt hypotheses, systemic findings, and design-level risk decisions.

InScope Tools & Skills

• Threat Hunting (TIP-driven): Execute standard and custom threat analysis and hunts; produce executive/detailed hunt reports
• Threat Modeling (Automated): ThreatModeler (or equivalent automated threat modeling tool) for security assessments of defined projects/apps 
• Red Teaming (Support): Support advanced adversary simulation exercises (planning support, evidence handling, reporting support
• Tuskira (Knowledge): Familiarity/working knowledge (e.g., exposure management / security posture / control gap insights) 

Key Responsibilities (L2)

1) Threat Hunting Execution (Standard + Custom)

• Execute standard threat analysis and hunts and document results with evidence and clear conclusions.
• Execute custom threat analysis and hunts based on operational triggers, threat intelligence inputs, or stakeholder requests.
• Support integration/consumption of threat intelligence inputs to improve hunt relevance and prioritization.

2) Threat Intelligence Operationalization for Hunts

• Recommend and refine threat intelligence feed usage that supports hunting objectives and improves signal quality.
• Provide operational guidance (what to look for”) derived from intelligence for quicker triage and validation.

3) Threat Modeling Assessments (ThreatModeler)

• Perform threat modeling assessments for projects/applications using ThreatModeler (or similar automated tooling) within defined scope
• Identify trust boundaries, attack paths, and control gaps; document risks and recommended mitigations in a consistent format. 
• Maintain assessment artifacts and ensure findings are tracked to closure through appropriate stakeholders. 

4) Red Teaming Support (L2)

• Support red team exercises by helping with coordination, scoping inputs, rules-of-engagement adherence, and evidence hygiene for reporting
• Assist in translating red team observations into actionable defensive improvements and hunt hypotheses

5) Reporting & Documentation

• Produce detailed hunt reports and contribute to executive summaries as needed, ensuring outputs are actionable and evidence-backed.
• Document repeatable hunt playbooks and threat model templates to improve operational consistency

Required Skills & Experience

• 4–7+ years in SOC/IR/threat hunting/detection engineering support roles
• Hands-on capability executing threat hunts and producing evidence-based reports
• Hands-on exposure to ThreatModeler (or equivalent) for application/project threat modeling assessments 
• Understanding of adversary tactics and translating them into hunt hypotheses and mitigation recommendations 

Preferred

• Exposure to red team/purple team workflows and reporting expectations 
• Tuskira familiarity (use cases, dashboards, posture insights)

Certifications (Preferred / Nice to Have)

• Threat hunting / incident response certifications (role-aligned)
• Threat modeling or application security certifications (role-aligned)