Staff Threat Intelligence Researcher

Arctic Wolf • New York, NY

2d • $86,000 - $240,000

About The Position

The Staff Threat Intelligence Researcher is an expert individual contributor aligned closely with the Adversary Operations team. The role leads rapid, intelligence-driven investigations into emerging threats, active campaigns, and high-impact adversary activity using internal managed detection and response (MDR), incident response (IR), endpoint, network, cloud, identity, malware, infrastructure, and open-source data. The researcher connects signals across customer environments, develops defensible campaign and actor assessments, and translates findings into timely hunting guidance, durable detections, incident response actions, customer protections, and authoritative reporting.

The position independently leads complex adversary investigations and helps shape how the organization identifies, validates, tracks, and responds to emerging threats across a large, multi-customer telemetry environment. It is expected to serve as a recognized authority in adversary research and response by developing repeatable campaign-investigation tradecraft, mentoring other researchers, and producing original research that improves customer protection and industry understanding of active threats.

The work involves solving complex, ambiguous problems with incomplete telemetry, noisy or deceptive indicators, uncertain attribution, multi-stage intrusions, and activity distributed across customer environments. The researcher forms and tests competing hypotheses, assesses confidence and impact, identifies evidence gaps and alternative explanations, and makes time-sensitive recommendations.

Requirements

• Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a related discipline, with demonstrated technical leadership as a senior individual contributor.
• Deep knowledge of nation-state, cybercriminal, ransomware, initial-access, malware, and vulnerability-exploitation ecosystems.
• Demonstrated experience hunting across large-scale endpoint, network, cloud, identity, email, and security-operations telemetry using SIEM, EDR, data-lake, or similar analysis platforms.
• Strong ability to use SQL, Python, Kusto Query Language, SPL, or comparable languages to analyze large datasets, automate enrichment, and build reusable research workflows.
• Experience analyzing host and network telemetry such as process execution, command lines, authentication events, DNS, proxy, firewall, Zeek, Sysmon, auditd, and cloud audit logs.
• Experience translating intelligence into YARA, Sigma, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements.
• Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence.
• Familiarity with malware-analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities.
• Proven ability to author publication-quality threat research and communicate technical findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences.
• Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or fast-moving security incidents.
• Remote interview candidates are expected to be on camera during all video interviews; candidates who anticipate technical, bandwidth, or location-related challenges must notify the company in advance.

Responsibilities

• Lead rapid-response research into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity that may affect customers.
• Proactively hunt across internal MDR and IR telemetry to identify active campaigns, previously unknown infrastructure, malware, intrusion patterns, and common adversary behaviors across customer environments.
• Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source data to develop and test campaign hypotheses.
• Scope potentially widespread activity by determining affected customers, observed behaviors, intrusion timelines, infrastructure overlap, and confidence in campaign or actor clustering.
• Produce time-sensitive intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings during high-impact security events.
• Develop and operationalize YARA, Sigma, behavioral analytics, search logic, indicators, and detection hypotheses in partnership with detection engineering, threat hunting, and security operations teams.
• Partner with Adversary Response and Incident Response teams during active investigations, providing adversary context, collection requirements, analytical judgments, and follow-on hunting recommendations.
• Establish and apply rigorous standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation.
• Build repeatable research methods, tooling, and automation that reduce the time from initial signal to validated finding and customer protection.
• Publish high-quality internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums.
• Develop repeatable campaign-investigation tradecraft, mentor other researchers, and produce original research that improves customer protection and industry understanding of active threats.

Benefits

• Equity for all employees
• Flexible time off and paid volunteer days
• 401(k) contribution and matching
• Training and career development programs
• Comprehensive private benefits plan including medical, mental health, dental, disability, life and AD&D, and value-added services
• Employee Assistance Program (EAP) with mental health services
• Fertility support and paid parental leave
• Variable incentive compensation
• New hire equity grants

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed