Threat Researcher II: Content & Detection Pro (Equity)

Arctic Wolf Networks Ireland Limited; Cork; On-site; EUR 48,000 - 105,000; Full time

Benefits offered by this job

Equity for all employees

28 days annual leave

Private medical plan

Pension plan

EAP program

Employee discount

Job summary

Arctic Wolf Networks Ireland Limited is seeking a Threat Intelligence Content Engineer to develop detection and telemetry rules for Aurora Focus (EDR). You will translate investigations into new content, tune detections, and work with Security Services on emerging threats.

A strong foundation in threat research, MITRE ATT&CK, and scripting is essential. You will manage multiple tasks, document new tools and processes, and participate in regression testing, production releases, and Purple Teaming

Qualifications

• 2+ years in threat intelligence or threat research
• Experience applying MITRE ATT&CK to intelligence products
• Experience analyzing application and infrastructure telemetry
• Experience analyzing phishing and malware campaigns and data breaches
• Understanding of SIEM/XDR/EDR tooling
• Experience using Python scripts
• Understand JSON and regex usage
• Linux and MacOS Terminal usage
• Basic shell scripting (.sh/.bat)
• Experience with Git repositories
• Experience with Virtual Machines (VMware)
• SQL knowledge; Databricks is a plus
• Knowledge of LOLBins/Sigma Rules

Responsibilities

• Analyse, research, and develop new content for Aurora Focus using MITRE ATT&CK.
• Convert investigations into new content (detection/telemetry rules).
• Collaborate on investigations regarding threats to generate new detection rules.
• Fine tuning of detections and false positives; implement exclusions or logic changes.
• Push production releases and notification emails.
• Participate in Purple Teaming exercises and threat briefings.
• Generate metrics over Databricks Dashboard.
• Deliver regular threat briefing presentations to stakeholders.

Skills

MITRE ATT&CK

Python scripting

Regex usage

Git repositories

Linux terminal

SQL knowledge

Threat intelligence

Tools

VMware Workstation

Databricks

Elastic Stack

Kibana

Grafana

Sigma Rules

Job description

Arctic Wolf Networks Ireland Limited is seeking a Threat Intelligence Content Engineer to develop detection and telemetry rules for Aurora Focus (EDR). You will translate investigations into new content, tune detections, and work with Security Services on emerging threats.

A strong foundation in threat research, MITRE ATT&CK, and scripting is essential. You will manage multiple tasks, document new tools and processes, and participate in regression testing, production releases, and Purple Teaming