Threat Researcher 2

Arctic Wolf Networks India; Cork; On-site; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Equity for all employees

28 days annual leave

Private benefits plan including health

Pension Plan

Employee Assistance Program (EAP)

Employee Discount Program

Job summary

Arctic Wolf is seeking a Threat Content Engineer to join the Threat Content Team. You will develop detection and telemetry content for Aurora Focus (EDR), applying MITRE ATT&CK to map TTPs to content and working with security service teams on investigations.

The role involves turning investigations into detection rules, refining rules to reduce false positives, and contributing to tooling, dashboards, and production releases. Strong scripting and telemetry analytics are required.

Qualifications

• 2+ years in threat intelligence or threat research.
• Experience applying the MITRE ATT&CK framework to intelligence products.
• Experience analysing application and infrastructure telemetry (logs, metrics, etc).
• Experience analyzing phishing/malware campaigns and data breaches.
• Understanding of SIEM/XDR/EDR tooling.
• Experience with Python scripting.
• Familiarity with JSON and regex usage.
• Linux and MacOS terminal usage.

Responsibilities

• Analyse, research, and develop new content for Aurora Focus using MITRE ATT&CK.
• Convert investigations into new detection/telemetry rules.
• Collaborate on investigations with Security Services on emerging threats.
• Fine-tune detections, manage false positives, and implement exclusions.
• Push production releases and notify stakeholders of updates.
• Generate metrics and run end-to-end testing.
• Deliver threat briefings to internal and external stakeholders.
• Maintain up-to-date documentation for tools and processes.

Skills

Threat intelligence

MITRE ATT&CK

Python scripting

Regex usage

Linux/MacOS terminal

Git repositories

SQL/Databricks

Threat research

Education

Cybersecurity certifications

Tools

SIEM

XDR/EDR

Databricks

VMware

GitHub

Kibana

Grafana

Sigma Rules

Job description

#RunwiththePack

At Arctic Wolf, we're on a mission to end cyber risk .

We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity.

More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.

We're constantly looking for talented people to join the Pack and help us take our performance to the next level.

About the Position:

About the Team:

Arctic Wolf Threat Content Team is the owner and intellectual author of the telemetry and detection rules of our Aurora Focus (EDR) product, part of Aurora Endpoint Defense.

Our Team started only 4 years ago in BlackBerry-Cylance. Since then we have developed many internal tools to streamline our daily tasks, defined work standards and how to create content (detection/telemetry rules), and high fidelity content (fine tune processes, reduce f+), created quality assurance processes (Unit Test, Regression and E2E Testing), communication channels with other areas of Threat Intel and Security Services, without neglecting our main mission which is end cyber risk.

About the Role and Responsibilities:

• Analyse, research, and develop new content for Aurora Focus, applying MITRE ATT&CK framework.
• Convert investigations performed by our Threat Teams: TRI\ATD\CTI into new content (detection/telemetry rules).
• Customer Escalation (BFD), collaborate with Security Services teams on investigations regarding emerging threats, to generate new detection rules.
• Fine tuning: determining true threats or false positives, and providing solutions, like exclusions, logic change or decreasing severity.
• Python scripting to automate new internal tools or projects.
• Ability to effectively manage multiple tasks simultaneously; coordinating and ensuring scheduled goals are met.
• Maintain documentation up to date: about a new tool or process we add.
• Run regression and end-2-end testing
• Push production releases, and notification emails.
• Participate in Purple Teaming exercises
• Generate metrics over Databricks Dashboard.
• Deliver regular threat briefing presentations to internal & external stakeholders on topics ranging from threat actor campaign activity, novel TTPs, and emerging malware or exploits
• Utilize best practices for threat research and documentation and deliver high-quality detection rules.

About You

• Relevant experience in a professional setting for threat intelligence or threat research roles, 2+ years.
• Experience with applying the MITRE ATT&CK framework to intelligence products and associated depth of analysis for each TTP and threat actor represented in this body of knowledge
• Experience analysing application and infrastructure telemetry (application logs, network flow logs, audit logs, metrics, core dumps, etc.)
• Experience analysing and deriving intelligence from phishing and malware campaigns, vulnerabilities being exploited in the wild, supply chain attacks, and Data breaches
• Understanding of threat protection/detection tooling/stacks: SIEM, XDR/EDR
• Experience working with Python scripts.
• Understand Json format and regex usage.
• Linux and MacOS Terminal usage
• Basic .sh/.bat scripting knowledge
• Windows sysinternals
• Experience using Git repositories (GitHub, Git Bash, GitLab)
• Experience using Virtual Machines (VMware workstation)
• SQL Knowledge, Databricks is a plus.
• Lolbins/Lolbas Knowledge
• Sigma Rules Knowledge
• Excellent written and verbal communication skills
• Resourceful self-starter with a positive, can-do attitude

Nice to Have:

• Experience with Agile Methodology
• Experience using Elastic search, Kibana or Grafana.
• You have delivered presentations on cybersecurity or cyber threat intelligence at industry conferences or meetups
• You have participated in sharing of threat intelligence through ISACs, Trust Groups, intelligence partnerships, or via other open communities
• CISSP, OSCP, GCTI or other relevant certifications are a plus

Benefits

All wolves receive compelling compensation and benefits packages, including:

• Equity for all employees
• 28 days annual leave, 10 public holidays, and paid volunteering days off
• Comprehensive private benefits plan including medical, optical and dental, life insurance and group income protection
• Pension Plan with employer contribution
• Robust Employee Assistance Program (EAP) with mental health service
• Employee Discount Program with Beneplace

Security Requirements

At Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security polic