Threat Researcher 2

VulnU; Cork; Hybrid; EUR 48,000 - 105,000; Full time

Benefits offered by this job

Retirement match

Equity

Paid parental leave

Flexible PTO

Learning budget

Job summary

Arctic Wolf is seeking a Threat Researcher to join our Threat Content Team in Cork. You will analyze, research, and develop new content for our Aurora Focus product, translating investigations into detection rules and telemetry content while collaborating with Threat Intel and Security Services.

You will apply MITRE ATT&CK, work with Python scripting to automate internal tools, and deliver regular threat briefings.

Qualifications

• Relevant experience in threat research or threat intelligence roles (2+ years).
• Experience applying MITRE ATT&CK framework to intelligence products and depth of analysis for each tactic and technique.
• Experience analysing application/infrastructure telemetry (logs, flows, metrics, core dumps).
• Experience analyzing phishing/malware campaigns and data breaches.

Responsibilities

• Analyse, research, and develop new content for Aurora Focus detection/telemetry rules.
• Convert investigations into new content; collaborate with Security Services on investigations of threats.
• Fine-tune detections by reducing false positives and adjusting logic.
• Produce and deliver threat briefings to internal and external stakeholders.

Skills

Threat research

Python scripting

MITRE ATT&CK

Threat intelligence

Regex usage

Tools

Git repositories

VMware workstation

Databricks

Elastic search

Kibana

Job description

# Threat Researcher 2Arctic Wolf · arcticwolf.comCategory: Security ResearchLocation: Cork, IRL## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Retirement match* Equity* Paid parental leave* Flexible PTO* Learning budget#RunwiththePackAt Arctic Wolf, we’re on a mission to end cyber risk. We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity. More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference. We’re constantly looking for talented people to join the Pack and help us take our performance to the next level. About the Position:About the Team:Arctic Wolf Threat Content Team is the owner and intellectual author of the telemetry and detection rules of our Aurora Focus (EDR) product, part of Aurora Endpoint Defense.Our Team started only 4 years ago in BlackBerry-Cylance. Since then we have developed many internal tools to streamline our daily tasks, defined work standards and how to create content (detection/telemetry rules), and high fidelity content (fine tune processes, reduce f ), created quality assurance processes (Unit Test, Regression and E2E Testing), communication channels with other areas of Threat Intel and Security Services, without neglecting our main mission which is end cyber risk.About the Role and Responsibilities:Analyse, research, and develop new content for Aurora Focus, applying MITRE ATT&CK framework.Convert investigations performed by our Threat Teams: TRI\\ATD\\CTI into new content (detection/telemetry rules).Customer Escalation (BFD), collaborate with Security Services teams on investigations regarding emerging threats, to generate new detection rules.Fine tuning: determining true threats or false positives, and providing solutions, like exclusions, logic change or decreasing severity.Python scripting to automate new internal tools or projects.Ability to effectively manage multiple tasks simultaneously; coordinating and ensuring scheduled goals are met.Maintain documentation up to date: about a new tool or process we add.Run regression and end-2-end testingPush production releases, and notification emails.Participate in Purple Teaming exercisesGenerate metrics over Databricks Dashboard.Deliver regular threat briefing presentations to internal & external stakeholders on topics ranging from threat actor campaign activity, novel TTPs, and emerging malware or exploitsUtilize best practices for threat research and documentation and deliver high-quality detection rules.About YouRelevant experience in a professional setting for threat intelligence or threat research roles, 2 years.Experience with applying the MITRE ATT&CK framework to intelligence products and associated depth of analysis for each TTP and threat actor represented in this body of knowledgeExperience analysing application and infrastructure telemetry (application logs, network flow logs, audit logs, metrics, core dumps, etc.)Experience analysing and deriving intelligence from phishing and malware campaigns, vulnerabilities being exploited in the wild, supply chain attacks, and Data breachesUnderstanding of threat protection/detection tooling/stacks: SIEM, XDR/EDRExperience working with Python scripts.Understand Json format and regex usage.Linux and MacOS Terminal usageBasic .sh/.bat scripting knowledgeWindows sysinternalsExperience using Git repositories (GitHub, Git Bash, GitLab)Experience using Virtual Machines (VMware workstation)SQL Knowledge, Databricks is a plus.Lolbins/Lolbas KnowledgeSigma Rules KnowledgeExcellent written and verbal communication skillsResourceful self-starter with a positive, can-do attitudeNice to Have:Experience with Agile MethodologyExperience using Elastic search, Kibana or Grafana.You have delivered presentations on cybersecurity or cyber threat intelligence at industry conferences or meetupsYou have participated in sharing of threat intelligence through ISACs, Trust Groups, intelligence partnerships, or via other open communitiesCISSP, OSCP, GCTI or other relevant certifications are a plus BenefitsAll wolves receive compelling compensation and benefits packages, including:Equity for all employees 28 days annual leave, 10 public holidays, and paid volunteering days off Comprehensive private benefits plan including medical, optical and dental, life insurance and group income protectionPension Plan with employer contributionRobust Employee Assistance Program (EAP) with mental health service Employee Discount Program with Beneplace Security Requirements At Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security policies, standards, and controls designed to safeguard the confidentiality, integrity, and availability of business, customer, employee, and other confidential information and to support compliance with applicable legal and regulatory requirements. Depending on the role and where permitted by applicable law, employment may be subject to background verification and additional regulatory, security, or compliance requirements, including obligations related to data protection and export control laws, and authorization requirements where applicable. Base SalaryThe base salary range for this job family is 48,000 to 105,000 EUR annually. This range reflects the base pay the company reasonably expects to offer for this position, aligned to the broader job family base pay structure. Actual base pay may vary based on skills, experience, and location, including job family level. In addition to base pay, Arctic Wolf offers variable incentive compensation, new hire equity grants, and a comprehensive benefits package. Your next big opportunity starts here — apply today and help us end cyber risk.