Threat Researcher II: Threat Intel & Detection Rules

Arctic Wolf; Cork; On-site; EUR 48,000 - 105,000; Full time

Benefits offered by this job

Equity for all employees

28 days annual leave

Private benefits plan with medical/dod

Pension Plan

EAP (employee assistance)

Employee Discount Program

Job summary

Arctic Wolf is seeking a Threat Content Engineer to join the Threat Content Team. You will research, develop, and refine Aurora Focus content, applying the MITRE ATT&CK framework to detections and telemetry rules.

You’ll transform investigations into actionable rules and collaborate across Security Services on emerging threats. You will fine-tune detections, automate tasks with Python, and help maintain comprehensive documentation.

Qualifications

• 2+ years in threat intelligence or threat research roles.
• Experience applying MITRE ATT&CK to intelligence products.
• Experience analyzing application and infrastructure telemetry.
• Experience analyzing phishing, malware campaigns, and data breaches.
• Understanding SIEM/XDR/EDR tooling.
• Familiarity with Python scripts and regex.
• Proficient in JSON format and scripting.
• Experience with Git repositories.

Responsibilities

• Analyse, research, and develop new content for Aurora Focus using MITRE ATT&CK.
• Translate investigations into new detection/telemetry rules.
• Collaborate with Security Services on investigations of threats to generate rules.
• Fine-tune detections to reduce false positives and adjust logic as needed.
• Automate tasks using Python scripts.
• Manage multiple tasks and ensure timelines are met.
• Maintain up-to-date documentation of tools and processes.
• Run regression and end-to-end testing, push production releases.

Skills

Threat intelligence

MITRE ATT&CK

Python scripting

Regex usage

Git repositories

Linux/macOS terminal

SQL (Databricks)

Threat data analysis

Tools

GitHub / Git Bash / GitLab

VMware Workstation

Databricks

Elasticsearch / Kibana / Grafana

Job description

Arctic Wolf is seeking a Threat Content Engineer to join the Threat Content Team. You will research, develop, and refine Aurora Focus content, applying the MITRE ATT&CK framework to detections and telemetry rules.

You’ll transform investigations into actionable rules and collaborate across Security Services on emerging threats. You will fine-tune detections, automate tasks with Python, and help maintain comprehensive documentation.