Threat Intelligence Lead

Obsidian Security•Palo Alto, CA

About The Position

Obsidian Security is the leading SaaS security platform, trusted by global enterprises like Snowflake, T-Mobile, and Algolia. We protect 200+ organizations across North America, Europe, the Middle East, Southeast Asia, Australia, and New Zealand, including many of the world’s largest Fortune 1000 and Global 2000 companies. Founded in 2017 and backed by top investors like Greylock, Obsidian was built to close a critical gap: securing SaaS apps where business happens—Microsoft 365, Salesforce, and hundreds more. The company does this by offering a complete SaaS security platform to reduce risk, detect and respond to threats, and prevent breaches at the source. Obsidian was built by leaders who redefined endpoint and identity security at CrowdStrike, Okta, Cylance, and Carbon Black. Now, they’re transforming how SaaS is secured. With AI driving rapid SaaS growth and complexity, agentic AI tools gain privileged access to sensitive data through integrations, creating new risks most security tools miss. Obsidian uniquely detects anomalous OAuth token activity and manages integration risks. Major announcements are on the horizon. Recognizing that SaaS security needs to evolve, Obsidian enables growing organizations to start with a lightweight, prevention-focused browser extension and expand coverage over time. With global momentum, a growing partner ecosystem including SentinelOne, Databricks, and Google Cloud, and a major fundraise ahead, Obsidian is scaling rapidly toward long-term growth and IPO readiness. We're looking for a Threat Intelligence Lead to join our team and build the function that tells Obsidian what threats matter, why, and what we do about them. The ideal candidate for the role will be a highly technical, passionate, team-oriented professional who can turn a noisy flood of external threat reporting into prioritized, actionable intelligence for both our product and our corporate environment — and then go hunt for it in our own telemetry. The ideal person for this role must be mission and values-driven, must have an ownership mentality, and must put the well-being of our customers, our teammates, and our organization at the forefront of how they operate. This person must be able to operate and thrive in a dynamic, high-growth startup environment within a young and growing Security, GRC, and IT team and programs. This is a critical, high-impact role that will serve as a catalyst for growth for any seasoned cybersecurity professional. The role reports to the Head of Security, works within the Trust Team, partners closely with IT, Engineering, Product, GRC, the Threat Research Lab, and cross-functionally as needed. They will have the support and autonomy to mature, deepen, and scale Obsidian's existing threat intelligence and threat hunting capability. Candidates applying for this sensitive and high-impact role should be highly technical team players with real analytical depth and the judgment to separate signal from noise. They should also have the ability to operate across a cloud-native organization with a cybersecurity mission and a modern tech stack. This is a multi-faceted role within a fast-moving startup and will require the successful candidate to possess an ownership mentality, sound judgment, personal responsibility, and initiative.

Requirements

At least 6 years of experience in threat intelligence, threat hunting, detection engineering, incident response, or security operations. Level commensurate with experience.
Demonstrated ability to analyze threat data and produce clear, prioritized, actionable assessments for varied audiences.
Hands-on threat hunting experience across cloud, SaaS, and endpoint telemetry, with fluency in MITRE ATT&CK and the intelligence lifecycle.
Working knowledge of the security capabilities and attack surface of modern IT and SaaS systems such as Okta, Google Workspace, Salesforce, Slack, Notion, and Jira.
Experience with SIEM query languages and with scripting for automation and enrichment in a language such as Python.
Familiarity with intelligence sharing standards and tooling (STIX/TAXII, MISP, OpenCTI, or similar).
Be obsessive about security while doing everything possible to support the overall mission.

Nice To Haves

A person who is excited about working at an industry-leading cybersecurity startup operating at the cutting edge of the field, defending against state-of-the-art threats.

Responsibilities

Collect, correlate, and synthesize threat intelligence from commercial feeds, open source reporting, ISACs, vendor advisories, researcher communities, and dark web sources into a single coherent picture.
Assess the applicability of each emerging threat, campaign, and vulnerability to the Obsidian product and to Obsidian's corporate infrastructure — and say clearly whether it matters to us and why.
Produce timely, decision-grade intelligence products: threat advisories, actor and campaign profiles, and periodic briefings for both technical teams and leadership.
Track threat actors targeting SaaS, cloud, and identity infrastructure, and maintain a living view of the TTPs most relevant to our customers and to us, mapped to MITRE ATT&CK.
Own the intelligence requirements process — define what we need to know, and drive collection against it rather than reacting to whatever crosses the wire.
Run structured, hypothesis-driven threat hunts across corporate and product environments based on IOCs, TTPs, and intelligence-derived leads.
Operationalize indicators into detections, and drive the enrichment and lifecycle management of IOCs so they stay useful instead of stale.
Write and tune the detections yourself — convert hunt findings into durable detection logic, playbooks, and response actions, and partner with incident response to operationalize them.
Support incident investigations with attribution context, actor tradecraft, and pivoting off known infrastructure.
Contribute to purple team exercises and validate that our controls actually detect what the intelligence says we should care about.
Be the customer zero of the Obsidian product — use it at full capability to secure our own corporate assets, run hunts inside it, and pressure-test it the way our most demanding customers do.
Identify use-cases to address, provide feedback on in-development features, and reshape workflows in the product.

Benefits

Opportunities for professional development
Opportunities to make high-impact contributions to security
Opportunities to influence the Obsidian product
Annual conference attendance budget
Competitive salary, equity, and health benefits
Opportunity to publish research, share non-proprietary code, and present at conferences
Competitive compensation with equity and 401k
Comprehensive healthcare with dental and vision coverage
Flexible paid time off and paid holiday time off
12 weeks of new parent or family leave
Personal and professional development resources