Senior Threat Intelligence Researcher
Posted Updated 14
views
Description
Job Summary
Responsibilities
Threat Intelligence Research and Adversary Tracking
Intelligence-to-Detection and Operational Impact
Automation, Scalability, and Analytical Excellence
Collaboration, Technical Leadership, and Knowledge Sharing
You will be successful in this role if
Disclaimer: This job posting and Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
We are looking for a Senior Threat Intelligence Researcher to help achieve this mission. The Senior Threat Intelligence Researcher will contribute to our Threat Intelligence organization by leading advanced cyber threat intelligence research and translating adversary insights into measurable defensive outcomes. This role focuses on deep technical analysis, adversary tracking, intelligence-driven detection, and operational collaboration to improve threat visibility, detection coverage, and incident response effectiveness across the organization. As a senior technical authority, this role will shape intelligence methodologies, establish analytical standards, mentor peers, and deliver actionable intelligence that directly strengthens Arctic Wolf's security operations and customer protection capabilities.
Responsibilities
Threat Intelligence Research and Adversary Tracking
- Lead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.
- Own end-to-end cyber threat intelligence investigations, from initial research and hypothesis development through validation, reporting, and operational implementation.
- Conduct cyber threat intelligence research aligned with established frameworks such as the Cyber Threat Intelligence lifecycle, MITRE ATTCK, and the Diamond Model.
- Perform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.
- Investigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts.
- Apply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.
- Research Deep Web ecosystems, including crimeware-as-a-service and ransomware-as-a-service operations, to identify emerging threats, adversary relationships, and evolving attack methodologies.
- Analyze Windows and macOS internals, including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.
- Analyze and correlate large-scale datasets using SQL, Python, or Excel to identify patterns, generate actionable intelligence, and support evidence-based decisions.
Intelligence-to-Detection and Operational Impact
- Translate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata.
- Own the lifecycle of intelligence-driven detection improvements, from identifying intelligence gaps and developing detection hypotheses to validating coverage and measuring operational effectiveness.
- Take accountability for ensuring that intelligence findings are translated into practical defensive improvements rather than remaining limited to research reports or theoretical assessments.
- Develop intelligence-to-detection feedback loops that identify coverage gaps, assess detection effectiveness, and continuously improve defensive capabilities.
- Partner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, investigation, and response workflows.
- Provide escalation support for high-confidence threat events, including intelligence enrichment, attribution context, assessment of potential impact, and recommended response actions.
- Contribute real-time intelligence support during active incidents and investigations, ensuring findings are communicated promptly and translated into actionable recommendations.
- Support Request for Intelligence workflows by owning assigned requests from initial assessment through research, delivery, and follow-up, ensuring that outputs address the operational teams requirements.
- Evaluate the effectiveness of intelligence-led initiatives using measurable outcomes such as detection coverage, investigation efficiency, escalation quality, and response time improvements.
Automation, Scalability, and Analytical Excellence
- Develop automation and enrichment workflows using scripting languages such as Python to improve research efficiency, data quality, and intelligence delivery.
- Identify opportunities to eliminate repetitive manual activities and build scalable intelligence workflows that support growing operational requirements.
- Own the implementation and continuous improvement of assigned automation initiatives, ensuring they deliver measurable efficiency gains and remain reliable in production environments.
- Establish repeatable research methodologies, intelligence validation practices, and analytical standards to improve consistency, accuracy, and reproducibility.
- Analyze operational feedback, detection gaps, and intelligence quality metrics to identify improvement opportunities and prioritize initiatives based on their potential security impact.
- Create scalable intelligence dissemination methods, including threat alerts, intelligence briefs, technical reports, and knowledge base updates, ensuring that relevant teams receive timely and actionable information.
Collaboration, Technical Leadership, and Knowledge Sharing
- Collaborate with Detection Engineering, Threat Hunting, Incident Response, Security Operations Center, and Managed Detection and Response teams to align intelligence priorities with operational and customer security needs.
- Take ownership of assigned intelligence initiatives and drive them forward independently, coordinating with relevant stakeholders to resolve dependencies and achieve agreed outcomes.
- Provide technical guidance and mentorship to peers, share investigative techniques, and contribute to the development of technical standards within the research organization.
- Communicate complex technical findings clearly to technical and operational audiences, ensuring that recommendations are understood, actionable, and aligned with business priorities.
- Publish technical research, tradecraft methodologies, blogs, and whitepapers, or present findings at industry workshops and conferences.
- Stay informed about emerging adversary tactics, techniques, and procedures, assess their relevance to Arctic Wolf customers, and proactively recommend improvements to intelligence coverage and defensive capabilities.
You will be successful in this role if
- You have 5+ years of relevant experience and are recognized as a technical authority within one or more adversary ecosystems, such as ransomware, financially motivated crimeware, or nation-state operations.
- You have strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.
- You have hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.
- You have experience with malware analysis tooling, host telemetry, and network telemetry analysis.
- You possess strong knowledge of modern threat intelligence frameworks, analytical methodologies, and adversary research techniques.
- You demonstrate end-to-end ownership by independently driving investigations and intelligence initiatives from problem identification through execution, validation, and measurable outcomes.
- You can translate complex intelligence findings into actionable recommendations and demonstrate how your work improves detection coverage, investigation quality, or defensive capabilities.
- You take accountability for the quality, accuracy, timeliness, and operational relevance of your intelligence deliverables.
- You proactively identify gaps in intelligence coverage, investigative processes, and detection capabilities, and drive improvements without waiting for predefined instructions.
- You are comfortable working independently in ambiguous, fast-changing threat environments, making informed decisions, and adapting your approach as new evidence emerges.
- You have strong analytical, communication, and problem-solving skills, with the ability to explain technical findings and their operational implications.
Disclaimer: This job posting and Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
