Cybersecurity Threat Intelligence and Red Team Lead

This role leads threat intelligence functions and Red Team/Purple Team activities to continuously improve the organization’s ability to detect, respond to, and remain resilient against cyberattacks. The position works with SOC, CSIRT, and other teams to design and execute attacker-perspective simulations and improvement cycles for defensive capabilities.

Responsibilities include planning, building, operating, and leading threat intelligence activities. This involves collecting, processing, and analyzing threat information and organizing it into intelligence that is useful for the organization. The role also plans, promotes, and leads Red Team and Purple Team activities by conducting simulated cyberattacks from an attacker’s perspective, validating vulnerabilities, and developing effective defense strategies.

The position communicates cyberattack trends and incident examples internally and externally as appropriate. Activities may include preparing internal reports, planning study sessions and training, and supporting external information sharing and collaboration within the industry.

Required qualifications include advanced specialized knowledge and practical experience in cybersecurity technologies and attack methods. Relevant examples include threat intelligence, Red Team or penetration testing, and security assessments at financial institutions or large companies, as well as research into attack methods and the design of signatures or detection logic at security product vendors. Candidates must have broad technical knowledge of networks, operating systems, applications, cloud environments, and identity platforms, together with the ability to identify vulnerabilities and construct attack scenarios based on attack methods and TTPs. The posting seeks security specialists with sufficient expertise in attack techniques to counter attackers.

Preferred qualifications include CISSP, CISM, CISA, Registered Information Security Specialist, GIAC certifications such as GCTI, GREM, or GPEN, and OSCP. Experience analyzing attack methods and mapping them to detection and defense measures using frameworks such as MITRE ATT&CK and D3FEND is also preferred. Business-level English for collaboration with overseas offices and vendors is listed as a preferred qualification.

The role is based in Tokyo. It is a permanent full-time position with no fixed contract term and a six-month probationary period. Standard working hours are 8:40 to 17:10, with 7.5 working hours and a 60-minute break; flextime may apply depending on the department. Salary is determined according to company regulations and is available for discussion. Benefits include commuting allowance, meal assistance, social insurance, an employee stock ownership plan, childcare support, housing-related programs, asset-building support, and leisure support. Saturdays, Sundays, public holidays, year-end and New Year holidays, annual paid leave, and other special leave are provided according to the stated conditions.