Staff Threat Intelligence Researcher

🔥 19 hours ago

🌐 United States, Canada – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote

💵 $86k - $240k / year

⏰ Full Time

🔴 Lead

🕵️ Threat Intelligence Specialist

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Open for 1 day.
• Jobs at this company usually fill in 37 days.

Apply Now

Find Similar Remote Jobs

Arctic Wolf

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2012

The cybersecurity industry has an effectiveness problem. Every year new technologies, vendors, and solutions emerge, and yet despite this constant innovation we continue to see high profile breaches in the headlines. All organizations know they need better security, but the dizzying array of options leave resource-constrained IT and security leaders wondering how to proceed. At Arctic Wolf, our mission is to End Cyber Risk through effective security operations. To achieve this, we believe that organizations must do three key things:

📋 Description

• Independently lead complex adversary investigations and help shape how the organization identifies, validates, tracks, and responds to emerging threats across a large, multi-customer telemetry environment • Lead rapid-response research into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity • Proactively hunt across internal MDR and IR telemetry to identify active campaigns, previously unknown infrastructure, malware, intrusion patterns, and common adversary behaviors • Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source data to develop and test campaign hypotheses • Determine affected customers, observed behaviors, intrusion timelines, infrastructure overlap, and confidence in campaign or actor clustering • Produce time-sensitive intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings • Develop and operationalize YARA, Sigma, behavioral analytics, search logic, indicators, and detection hypotheses with detection engineering, threat hunting, and security operations teams • Partner with Adversary Response and Incident Response teams during active investigations • Establish and apply standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation • Build repeatable research methods, tooling, and automation to reduce time from initial signal to validated finding and customer protection • Publish internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums • Mentor other researchers and develop repeatable campaign-investigation tradecraft

🎯 Requirements

• Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a related discipline, with demonstrated technical leadership as a senior individual contributor • Deep knowledge of nation-state, cybercriminal, ransomware, initial-access, malware, and vulnerability-exploitation ecosystems • Demonstrated experience hunting across large-scale endpoint, network, cloud, identity, email, and security-operations telemetry using SIEM, EDR, data-lake, or similar analysis platforms • Strong ability to use SQL, Python, Kusto Query Language, SPL, or comparable languages to analyze large datasets, automate enrichment, and build reusable research workflows • Experience analyzing host and network telemetry such as process execution, command lines, authentication events, DNS, proxy, firewall, Zeek, Sysmon, auditd, and cloud audit logs • Experience translating intelligence into YARA, Sigma, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements • Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence • Familiarity with malware-analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities • Proven ability to author publication-quality threat research and communicate technical findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences • Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or fast-moving security incidents • Candidates interviewing remotely are expected to be on camera during all video interviews • Employment may be subject to background verification and additional regulatory, security, or compliance requirements, including data protection, export control, and authorization requirements where applicable

🏖️ Benefits

• Equity for all employees • Flexible time off and paid volunteer days • 401(k) contribution and matching • Training and career development programs • Comprehensive private benefits plan including medical, mental health, dental, disability, life and AD&D, and value-added services • Robust Employee Assistance Program (EAP) with mental health services • Fertility support and paid parental leave • Variable incentive compensation • New hire equity grants

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume