Cybersecurity Threat Research Located

Threat researchers study how cyber attackers actually operate - the malware they write, the infrastructure they rent, the phishing kits they sell and the techniques they reuse - and turn that into something defenders can act on. The output is usually detection rules, intelligence reports, product signatures or briefings for customers and internal security teams. The work sits in security vendors, managed security providers, large in-house security teams (banks, telecoms, government) and specialist consultancies. ("Located" in the advert title almost certainly refers to the job's location rather than anything about the work itself.)

Starting salary: £28k–£38k
Live graduate jobs: Search all jobs
Main way in: Graduate schemes at cybersecurity vendors, managed security…
They usually ask for: A degree is usual but the subject is flexible

Approximate graduate salary

Typically around £28,000–£38,000 to start, though this varies widely - security vendors and financial services in London tend to sit at the higher end, public sector and regional employers lower, and specialist technical roles with scarce skills can exceed this range. Salaries in this field tend to rise fairly quickly with demonstrated ability.

What you'd actually do

Pulling apart suspicious files in an isolated virtual machine (a 'sandbox') to see what they do - what they install, what servers they contact, how they try to hide - and writing up the findings
Writing and tuning detection logic: YARA rules that match patterns inside files, Sigma rules for log data, or queries in the employer's own detection platform, then checking they don't flood analysts with false alarms
Tracking attacker infrastructure - domains, IP addresses, TLS certificates, hosting providers - using internet scan data and passive DNS records to spot new servers before they're used
Reading and triaging a constant stream of inputs: telemetry from the company's products or network, open-source reporting, vendor feeds, and chatter from criminal forums and Telegram channels

Show 3 more

Writing reports at different levels - a short technical note with indicators of compromise for other analysts, or a longer piece explaining to a non-technical audience why a particular campaign matters to them
Mapping observed behaviour to shared frameworks such as MITRE ATT&CK (a public catalogue of attacker techniques) so findings can be compared across teams and over time
Supporting incident responders when something live is happening - identifying whether the malware found on a customer's network matches a known group and what it typically does next

How graduates get in

Graduate schemes at cybersecurity vendors, managed security service providers and large consultancies - common, though most start you in a security operations centre (SOC) doing alert triage rather than straight into research, with a move into threat intel or malware analysis after a year or two
Direct entry into a junior threat intelligence analyst or SOC analyst role and specialising from there - probably the most common route in practice
Government and defence routes - GCHQ, NCSC and defence contractors run graduate and apprenticeship schemes with strong research components. These require UK nationality and security clearance, and the clearance process takes months
Via a cyber security MSc, including conversion-style courses for graduates from other subjects. Useful but not required; a strong portfolio often counts for more than the degree title

Show 2 more

Self-taught entry on the strength of demonstrable work - published malware write-ups, capture-the-flag (CTF) competition results, contributions to open-source tooling, a blog of reverse-engineering notes. This is genuinely viable in this field in a way it isn't in many graduate careers
Internships and placement years with security vendors, and university cyber societies feeding into national competitions and talent programmes

What employers ask for

A degree is usual but the subject is flexible - computer science, software engineering, maths, physics and cyber security are the obvious ones, but people come in from linguistics, history and international relations, particularly on the intelligence-analysis side rather than the malware side
Most employers ask for a 2:1, some accept a 2:2 if you can show practical ability; a minority of smaller vendors and some government teams care very little about classification
Demonstrable hands-on evidence matters more here than in most graduate fields: a GitHub profile, CTF write-ups, a home lab, analysis of a real malware sample. Expect technical interviews that ask you to reason about actual code or logs
Programming ability, usually Python for tooling and automation. For malware-focused roles, familiarity with C and some assembly language is expected or will need to be learned fast

Show 2 more

Certifications are helpful but rarely mandatory for entry - names you'll see include CompTIA Security+ as a starting point, and more advanced malware and intelligence qualifications later. Employers often fund these once you're in
For government, defence and some critical-infrastructure employers: eligibility for UK security clearance (SC or DV), which generally means UK residency for a number of recent years and, for some roles, sole UK nationality

Skills that matter

Reverse engineering and low-level code reading

Working out what an unknown binary does - often one deliberately written to resist analysis - is the core technical task in malware-focused research roles.

Scripting and automation (usually Python)

The volume of samples and telemetry is far beyond manual review, so researchers constantly write throwaway scripts to parse, extract and correlate data.

Structured analytic thinking

You are reasoning from incomplete, sometimes deliberately misleading evidence to an attribution or assessment, and you need to separate what you observed from what you inferred.

Clear technical writing for mixed audiences

A finding that nobody reads or acts on is worthless, and the same campaign may need a rule for an engineer, a bulletin for analysts and a paragraph for an executive.

Operating systems and network internals

Recognising that a process is doing something abnormal depends on knowing in detail what normal Windows, Linux or cloud behaviour looks like.

Comfort with ambiguity and dead ends

Plenty of investigations end with no clear answer, and researchers need to judge when to stop digging and move to the next lead.

Putting these on a CV? We counted which skills 12,914 live graduate adverts ask for, and what to do with the answer — part of our application advice.

Where it leads

Junior/associate analyst - triaging alerts, enriching indicators, running samples through automated tooling and writing short internal notes under supervision. Typically the first year or two, though some graduates enter directly at analyst level with a strong portfolio.
Threat researcher or threat intelligence analyst - owning investigations end to end, tracking specific attacker groups or malware families, publishing externally under the employer's name.
Senior researcher - becoming the recognised internal expert on a region, a crime ecosystem (ransomware, banking trojans) or a technical specialism, mentoring juniors and speaking at industry conferences.
A fork in the road: principal/staff researcher staying deeply technical, or management of a research or intelligence team. Some move sideways into detection engineering, incident response, product management for security tooling, or into government intelligence work. Timelines vary a great deal and depend heavily on employer size.
Longer term: head of threat intelligence or research, chief information security officer routes via broader security management, independent consultancy, or founding a niche security product company. Public reputation built on published research is unusually valuable currency in this field.

What people get wrong

“It's mostly hacking - breaking into things and finding zero-days.”

That's penetration testing and vulnerability research, which are different jobs. Threat research is largely defensive and analytical: studying what attackers have already done and making it detectable. A lot of the week is reading, writing and building tooling.

“You need a computer science degree and strong coding from day one.”

The intelligence-analysis side of the discipline draws heavily on people with language, geopolitics and humanities backgrounds, and employers often value someone who can research a criminal forum in Russian or write a sharp assessment. Technical skill is learnable on the job; the appetite to keep learning is not optional.

“It's constant adrenaline and 24/7 incident response.”

Research roles are usually office-hours and project-shaped - a campaign might be tracked for months. The round-the-clock shift work sits with SOC and incident response teams, though researchers may be pulled in during a major event. Shift patterns vary a lot by employer.

“Attribution means naming the individual hacker.”

In practice attribution usually means clustering activity into a named group with a level of confidence attached, based on overlapping tooling and infrastructure. Identifying real people is rare, slow and generally a matter for law enforcement and government agencies.

Where this varies

The job differs a lot by employer type. At a security product vendor, research feeds directly into the product - you're writing detections that ship to customers, and publishing public blog posts is part of the marketing value you provide. At a managed security provider, work is customer-driven and closer to operations. In-house teams at banks, telecoms and retailers focus narrowly on threats to their own sector and rarely publish. Government and defence work is classified, requires clearance, and you may never be able to discuss your work externally - which some people find frustrating and others find freeing. Geographically, roles cluster in London, Cheltenham (government-linked), Manchester, Bristol and Belfast, though remote working is more common in this field than in many graduate careers. Also note the split between technical malware research and geopolitical/strategic intelligence analysis: some employers treat these as one job, others as entirely separate career tracks.

Search Cybersecurity Threat Research Located jobsFrom employers' own careers sites, updated daily Tailor your CV for this roleFree with an account, 3 a month

General guidance about the role across the UK market, not about any specific employer. Entry routes and requirements vary — always check the individual job advert.