Senior Threat Analyst, Rapid Response

TrendAI™, the global AI security leader and enterprise business unit of Trend Micro, empowers organizations with full AI visibility and consolidated security that inspires confidence, drives innovation, and eliminates risk.
 
At TrendAI™, we’re always seeking exceptional talent; people who want to collaborate with the best and push boundaries together. Here, your work goes beyond building a career. You will help protect what matters and play a vital role in shaping a safer, more trustworthy AI-powered future.
 
AI Fearlessly.

About the role

TRII turns TrendAI threat research into published work that reaches media, customers and the field. Rapid response is the fastest tier of that work: breaking and time-sensitive analysis published on a one to three day cycle, and the source of most of the team’s media pickups.

This role leads that function. It is a senior individual contributor position rather than a people management one. Writers report to the Director. This role owns the work, sets the standard for it, and is the escalation point for it.

The function is being built rather than maintained. A framework exists and is running regionally, the pipeline that feeds it is coming online, and the person in this role will finish building it and then run it globally.

What you will own

•             Own the rapid response model globally for TRII, scaling the existing framework from regional implementation to the standard the whole team works to, and finalizing the RACI with Threat Ops, AI Labs and Threat Hunt.

•             Run the activation path end to end: signal, score, tier, activate. Decide what TRII responds to, at what tier, and against what service level, holding P0 to a one to two day turnaround and keeping tactical publication inside the one to three day cycle.

•             Merge the two scoring systems now in use into one. A story should be scored once, and that score should route both publication and commercial activation rather than running as two parallel judgments.

•             Close the gap between the threat rapid response process and the market signals process run by product marketing, so that TRII operates one process rather than negotiating between two.

•             Stand up and run the listening function for threat, incident and breach signals, and for the market news that matters, working with Threat Research and Market Amplification rather than duplicating what they already watch.

•             Carry the drafting and first-pass editing of tactical output, working with threat researchers as expert reference to validate assumptions, analysis and technical accuracy rather than routing drafts to them for authorship.

•             Set and hold the editorial standard for tactical output: technically correct, saying something TrendAI is uniquely positioned to say, and reaching publication without losing the timeliness that made it worth publishing.

•             Serve as the escalation point for tactical work that is contested, blocked or moving too slowly, and bring it to the Director when it cannot be resolved inside the function.

•             Work with the AI and automation function to automate the monitoring and drafting steps that do not need a person, so that analyst time goes to judgment rather than collection.

•             Contribute to the weekly cadence of top threats communications, and to getting that work to the sales teams and customers with links back to the deeper reports.

•             Represent rapid response in the monthly business report and the leads meeting.

What we are looking for

•             Substantial experience as a cyber threat intelligence analyst, including a record of publishing analysis under time pressure that held up afterward.

•             Strong technical writing. You can take work from a technically deep source and make it land with a CISO, a practitioner and a journalist without flattening what makes it interesting.

•             Breadth across the threat landscape. This role reads across nation state activity, criminal operations, vulnerabilities and emerging AI threats, and decides quickly what deserves a response.

•             Judgment about what is worth publishing. A good deal of the value of this role is the decision not to respond to something.

•             Experience building or materially improving a process, not only working inside one.

•             Comfort working asynchronously across a distributed team, and the discipline to write things down so that work survives a handoff.

Desired Qualifications

•             Risk modeling or quantitative threat assessment.

•             Experience with incident communications or newsroom-style operations.

•             Familiarity with Jira-based intake and editorial workflow.

•             Experience working alongside automated drafting or summarization tooling.

•             Public speaking, briefing or media experience.