AI Nation-State Attribution Analyst

Corvex Intelligence

Remote · $130k – $160k / year · Full-time · Posted 4 months ago

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

This role is no longer accepting applications

Don't miss the next role like this

Create a free profile with your skills. We match you to new AI roles as they open, and companies hiring can contact you directly.

Create free profile, 2 minutes

Similar open roles you can apply to now:

See all open AI jobs

About the role

Attribution is the hardest problem in cyber threat intelligence. Anyone can see that an attack used Cobalt Strike and targeted energy sector companies. Determining whether that attack came from APT28, a copycat using purchased tooling, or a state-sponsored actor using deliberate false-flag techniques requires correlating behavioral fingerprints across campaigns spanning years, in the presence of adversaries who actively work to defeat attribution. We build attribution models for government clients and Fortune 100 companies whose threat intelligence teams don't have the data volume to train their own. Our proprietary dataset covers 8 years of campaign data across 140 tracked threat actors. You'll design ML models that extract behavioral signatures from malware samples, TTPs, and campaign timing patterns, and build the probabilistic attribution system that outputs confidence-weighted actor hypotheses rather than definitive labels. This role requires US citizenship and the ability to obtain security clearance. You'll work remotely but with occasional classified briefings via secure channels. The intelligence team is nine analysts and three ML engineers.

Fully remote.

Responsibilities

Design ML models extracting behavioral signatures for nation-state attribution
Build probabilistic attribution system with confidence-weighted actor hypotheses
Develop features from malware behavioral traces, TTPs, and campaign timing patterns
Implement false-flag detection to identify deliberate misattribution attempts
Maintain and update attribution models as new campaign data arrives
Produce confidence-qualified attribution reports for government and enterprise clients

Requirements

6+ years in ML with threat intelligence or cybersecurity domain experience
Experience with malware analysis, campaign tracking, or behavioral fingerprinting
Strong Python and statistical modeling skills
Understanding of nation-state threat actor TTPs and cyber campaign attribution challenges
US citizenship required; ability to obtain security clearance required