Cyber Threat Intelligence Researcher

Artemis•New York, NY

6d•$160,000 - $200,000

About The Position

Artemis is seeking a Cyber Threat Intelligence Researcher to lead original threat research and drive the company’s managed threat intelligence strategy. This hands-on individual contributor role investigates emerging threats, tracks attacker behavior, publishes research, and develops threat hunts that help customers find activity their existing defenses may miss. The researcher connects developments in the threat landscape to risks and activity in customer environments. The role owns research from the initial question through publication and operational use. It involves developing hypotheses, analyzing telemetry, investigating campaigns, writing blogs and intelligence reports, and turning discoveries into repeatable hunts. The researcher partners with detection engineers, offensive security, analysts, and product teams to translate intelligence into improved protection.

Requirements

At least 5 years of hands-on cybersecurity experience, with substantial work in threat intelligence, threat research, threat hunting, or incident investigation; equivalent demonstrated expertise is welcome.
A track record of producing original, evidence-backed research and clear technical writing; published work, anonymized reports, or other substantive research samples may demonstrate this experience.
Strong understanding of attacker tactics, techniques, and procedures, with depth in at least one relevant area such as cloud and identity attacks, SaaS compromise, cybercrime campaigns, or targeted intrusions.
Experience developing and executing hypothesis-driven hunts, analyzing security telemetry, and correlating activity across sources using SQL, KQL, SPL, or similar query languages.
Experience turning intelligence into operational outcomes, including detections, hunt content, incident insights, or customer guidance.
Practical Python and API skills for research automation, enrichment, and data analysis, with sound judgment when using AI to support research.
Strong analytical discipline, including evaluating source reliability, testing alternative explanations, communicating confidence, and avoiding overstated attribution or coverage.
Ability to prioritize research around customer risk, own work through delivery, and explain technical findings clearly to practitioners and leadership.
Good judgment when handling sensitive telemetry, source restrictions, and publication review, including protecting customer identities and confidential information.

Nice To Haves

Experience building or operating a managed threat intelligence service, defining intelligence requirements, or evaluating commercial and open-source intelligence feeds.
Research into AI-enabled attacks, agent security, software supply chains, or threats against data platforms.
Experience with malware analysis, infrastructure tracking, passive DNS, sandboxing, or adversary emulation.
Familiarity with MITRE ATT&CK and ATLAS, STIX/TAXII, intelligence platforms, or detection-as-code workflows.
Contributions to public research, conference talks, open-source intelligence tooling, hunt libraries, or detection content.
Customer-facing experience delivering threat briefings, research findings, or hunting outcomes in an MDR, MSSP, or security product environment.

Responsibilities

Conduct original research into emerging campaigns, attacker infrastructure, exploitation techniques, and adversary tradecraft across cloud, identity, endpoint, SaaS, AI, and data environments, using external reporting and authorized telemetry analysis.
Own the research roadmap and intelligence priorities for Artemis’s managed offering; define customer-relevant questions and threats, evaluate intelligence sources and partners, and establish how intelligence is collected, assessed, delivered, and maintained.
Write technical blogs, campaign analyses, threat advisories, and research reports explaining attack behavior, evidence, defensive implications, and practical hunting guidance for technical and executive audiences.
Develop and execute threat hunts by identifying relevant telemetry, creating queries and behavioral correlations, investigating results, and turning successful approaches into reusable hunt templates with clear prerequisites and limitations.
Track actors and campaigns by connecting infrastructure, tooling, victimology, and observed behaviors; maintain campaign and activity-cluster assessments that distinguish facts, analytical judgments, confidence levels, and attribution uncertainty.
Partner with detection engineers and the SOC to operationalize research as detections, investigation guidance, enrichment, and response recommendations; manage the quality and lifecycle of indicators and intelligence content, including provenance, relevance, confidence, and expiration.
Investigate how attackers use AI and target AI applications, agents, tools, and connected data; develop practical hypotheses and hunts while distinguishing demonstrated activity from speculation and identifying telemetry gaps.
Use Python, APIs, and AI-assisted workflows to automate collection, enrichment, correlation, and analysis; independently verify sources and conclusions, preserve evidence, and create repeatable workflows.
Brief customers and internal teams on relevant developments, explain exposure and observed activity, recommend next steps, measure impact through useful hunts, coverage improvements, and customer decisions, and refine the intelligence program based on feedback.