Threat Content Researcher – MITRE ATT&CK & EDR Focus

Arctic Wolf Networks India; Cork; On-site; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Equity for all employees

28 days annual leave

Private benefits plan including health

Pension Plan

Employee Assistance Program (EAP)

Employee Discount Program

Job summary

Arctic Wolf is seeking a Threat Content Engineer to join the Threat Content Team. You will develop detection and telemetry content for Aurora Focus (EDR), applying MITRE ATT&CK to map TTPs to content and working with security service teams on investigations.

The role involves turning investigations into detection rules, refining rules to reduce false positives, and contributing to tooling, dashboards, and production releases. Strong scripting and telemetry analytics are required.

Qualifications

• 2+ years in threat intelligence or threat research.
• Experience applying the MITRE ATT&CK framework to intelligence products.
• Experience analysing application and infrastructure telemetry (logs, metrics, etc).
• Experience analyzing phishing/malware campaigns and data breaches.
• Understanding of SIEM/XDR/EDR tooling.
• Experience with Python scripting.
• Familiarity with JSON and regex usage.
• Linux and MacOS terminal usage.

Responsibilities

• Analyse, research, and develop new content for Aurora Focus using MITRE ATT&CK.
• Convert investigations into new detection/telemetry rules.
• Collaborate on investigations with Security Services on emerging threats.
• Fine-tune detections, manage false positives, and implement exclusions.
• Push production releases and notify stakeholders of updates.
• Generate metrics and run end-to-end testing.
• Deliver threat briefings to internal and external stakeholders.
• Maintain up-to-date documentation for tools and processes.

Skills

Threat intelligence

MITRE ATT&CK

Python scripting

Regex usage

Linux/MacOS terminal

Git repositories

SQL/Databricks

Threat research

Education

Cybersecurity certifications

Tools

SIEM

XDR/EDR

Databricks

VMware

GitHub

Kibana

Grafana

Sigma Rules

Job description

Arctic Wolf is seeking a Threat Content Engineer to join the Threat Content Team. You will develop detection and telemetry content for Aurora Focus (EDR), applying MITRE ATT&CK to map TTPs to content and working with security service teams on investigations.

The role involves turning investigations into detection rules, refining rules to reduce false positives, and contributing to tooling, dashboards, and production releases. Strong scripting and telemetry analytics are required.