SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG’s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.
In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization’s extensive global network. The Group’s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.
Role Description
As a Cyber Security Analyst - Threat Researcher at the Associate level, you will independently research assigned cyber threats, vulnerability exploitation pathways, and AI-augmented attacks within SMBC Group’s Cyber Threat Intelligence program, with prioritization and review from senior team members. You will document evidence and analytical confidence, develop visual attack pathway models, and support SOC, vulnerability management, and security engineering teams in identifying detection, threat hunting, and mitigation opportunities relevant to SMBC Group’s technology environment and business services.
Role Objectives
Threat Research & Analysis:
• Research assigned threat actors, malware, and campaigns to identify attack patterns and adversary tactics, techniques, and procedures (TTPs), including emerging threats relevant to financial services.
• Analyze open-source and commercial intelligence and internal telemetry to inform threat models, documenting source credibility, analytical confidence, and intelligence gaps.
• Assess vulnerability advisories, proof-of-concept availability, reported exploitation, and remediation status to identify exploitation prerequisites, potential exposure, and compensating controls relevant to SMBC Group.
• Research AI-assisted reconnaissance, social engineering, impersonation, and malicious code development, distinguishing documented adversary activity from speculative claims, including claims of autonomous capability.
Attack Pathway Modeling:
• Develop and maintain evidence-based visual attack pathways mapped to MITRE ATT&CK techniques, incorporating vulnerability exploitation and AI augmentation where relevant and distinguishing observed behavior from analytical or hypothetical scenarios.
• Map exploitation prerequisites, potential privilege escalation and lateral movement, control dependencies, and business impact to observable activity and defensive intervention points, distinguishing exploit availability from evidence of enterprise compromise.
• Use attack pathways to support detection recommendations, threat hunt hypotheses, authorized simulations, and tabletop exercises, including financial-system scenarios where assigned.
Role Objectives
Tooling & Automation:
• Use available threat intelligence platforms and SIEM data to support research, collection, and analysis.
• Use approved visualization tools to create attack pathway diagrams and ATT&CK Navigator to map technique coverage.
• Support intelligence enrichment and workflow improvements, including basic scripting where applicable.
Reporting & Communication:
• Produce clear, actionable intelligence reports and visualizations for both technical and executive audiences.
• Present research findings and attack pathways in team briefings and contribute to planning discussions.
Collaboration & Integration:
• Work with SOC analysts, vulnerability management, asset owners, security engineering, security testing, cyber resilience, and threat modeling teams to validate exposure assumptions and inform detection, threat hunting, and remediation priorities; implementation remains with the responsible teams.
Qualifications and Skills
Required Qualifications:
• Three or more years of experience in cyber threat intelligence, threat research, or threat hunting within a SOC or information security program.
• Understanding of adversary tactics, techniques, and procedures and familiarity with MITRE ATT&CK.
• Ability to assess vulnerability advisories and exploitation reporting, identify exploitation prerequisites, and explain implications for enterprise exposure and defensive controls.
• Ability to develop clear visual attack pathways or kill chain diagrams.
• Familiarity with open-source or commercial threat intelligence and security telemetry used in threat analysis.
• Strong analytical, written, and verbal communication skills, including evaluating source credibility, documenting evidence and analytical confidence, and managing assigned research priorities.
Preferred Qualifications:
• Bachelor’s degree in cybersecurity, computer science, information technology, or a related field.
• Experience reviewing technical exploitation research or supporting authorized vulnerability validation in a controlled lab environment.
• Familiarity with adversary analysis approaches such as the Diamond Model, Cyber Kill Chain, or attack trees.
• Familiarity with KQL or Python for telemetry analysis, intelligence enrichment, or basic workflow automation.
• Experience researching AI-augmented cyber threats and distinguishing demonstrated capabilities from speculative claims.
• Experience in financial services or another regulated industry.
• Relevant threat intelligence or security certifications, such as GCTI or CTIA.
SMBC’s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.
SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at accommodations@smbcgroup.com.