Senior Threat Researcher (Integrations Team)

Arctic Wolf; Karnataka; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

Arctic Wolf is seeking a Senior Threat Researcher - Cloud & Endpoint Detection to join our Integrations Team. You will craft detections across endpoint, cloud, identity, and SaaS telemetry, guiding a team of detection engineers and collaborating with cross-functional groups to ensure broad XDR coverage.

The ideal candidate has 6+ years in detection engineering or related fields, expert Python skills, and deep understanding of telemetry sources including Windows Sysmon, Linux auditd, macOS logs,

Qualifications

• 6+ years of experience in Detection Engineering, Threat Hunting, Security Research, SOC Engineering, or Security Analytics.
• Expert-level Python expertise, with the ability to build detection tooling, automation, and frameworks.
• Deep understanding of diverse telemetry sources and their strengths and limitations, including Endpoint: Windows Security and Sysmon logs, Linux auditd, macOS Unified Logs, and EDR telemetry.
• Network: NetFlow, DNS, HTTP/TLS

Responsibilities

• Act as a technical leader and mentor to detection engineers across the XDR program and third-party integrations.
• Design detections that generalize across diverse customer environments and telemetry domains.
• Develop detections, correlation rules, and analytics based on telemetry ingested from third-party integrations.
• Validate detections against threat scenarios and real-world telemetry, and optimize coverage and performance.

Skills

Python programming

Threat detection

Security analytics

Job description

At Arctic Wolf, you will not just watch the cybersecurity industry evolve – you will help lead the change. Our global team is made up of people who thrive on solving complex problems, moving quickly, and building technology that protects organizations around the world. We are proud to be recognized by Forbes, CNBC, Fortune, CRN, Gartner Peer Insights, and International Data Corporation MarketScape. What matters most is the work behind these recognitions: delivering real outcomes for customers through award-winning innovation such as our Aurora Platform. If you are looking for meaningful work, smart teammates, and the opportunity to make a real impact in a high-growth company that is redefining security operations, Arctic Wolf is the right place for you. Our mission is simple: End Cyber Risk.

We are looking for a Senior Threat Researcher - Cloud & Endpoint Detection to join our Integrations Team and help achieve this mission. You'll be working as a Senior Detection Engineer within Integrations, Detection, & Response (IDR), reporting directly to the Manager of Detection Engineering, XDR while working closely with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams. This individual will be responsible for providing technical direction to deliver high-value, performant, generalized detections across many telemetry sources — endpoint, network, cloud, identity, and email — to provide broad Extended Detection and Response (XDR) coverage for customers. They will provide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale. This role sits at the intersection of security research, detection engineering, and integrations. The primary responsibility is to analyse data ingested from integrated security providers and transform that telemetry into actionable detection rules, correlation logic, and attack coverage. Initially, the role will focus heavily on detections powered by data from third‑party integrations, with opportunities to expand coverage across cloud, identity, endpoint, and Software as a Service (SaaS) ecosystems as new integrations are onboarded. The ideal candidate has a strong understanding of attacker behaviour, security telemetry, and detection engineering, with the ability to quickly learn new vendor schemas, Application Programming Interfaces (APIs), and event models to identify meaningful detection opportunities.

IN THIS ROLE, YOU WILL:

Third-Party Integration Detection Development

Act as a technical leader and mentor to detection engineers across the XDR program and third-party integrations. Serve as a detection subject matter expert within the Integrations Team. Apply broad expertise and knowledge across multiple telemetry domains, including endpoint, network, cloud, identity, and email, to design detections that generalize across diverse customer environments. Contribute to the development of detection strategies and principles to achieve coverage goals in creative and effective ways. Produce detection specifications and coverage models and determine operational feasibility. Develop detections, correlation rules, and analytics based on telemetry ingested from third-party integrations. Analyse vendor APIs, audit logs, alerts, and event schemas to identify security detection opportunities. Design detection coverage that leverages data from integrated security products, cloud providers, identity platforms, email security solutions, and endpoint security tools. Partner closely with integration engineers to understand newly onboarded data sources and maximize security value from collected telemetry. Provide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale.

Detection Research

Research emerging threats, attack techniques, and adversary tactics. Work on significant and unique detection challenges where analysis of attacker behaviour requires evaluation of complex, cross-domain signal correlation. Apply conceptual thinking to understand advanced threats, novel attack chains, and their implications across telemetry boundaries. Identify opportunities to detect malicious activity using third-party security and SaaS telemetry. Map detections to the MITRE ATT&CK framework and maintain alignment with evolving threat landscapes. Continuously improve existing detections by reducing false positives and increasing attack coverage. Exercise independent judgment in detection methodology, technique selection, and evaluation criteria for measuring detection efficacy. Provide thought leadership on cross-telemetry detection approaches and contribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.

Security Domain Coverage:

Develop detections across multiple security domains, including: Identity & Access Security Account takeover MFA abuse and bypass Privilege escalation Suspicious administrative activity Service account misuse OAuth and application abuse Email Security Business Email Compromise (BEC) Phishing campaigns Malicious attachment activity Email forwarding rule creation Suspicious mailbox access Abnormal email behaviours Endpoint Security Malware and ransomware activity Credential theft techniques Suspicious process execution Persistence mechanisms Lateral movement Defence evasion Living-off-the-land techniques Endpoint compromise indicators Cloud Security Excessive permission changes Suspicious cloud administration activity Data exfiltration attempts Resource misconfigurations Cloud account abuse Workload compromise activity Network Security Analyse network telemetry and cross-domain signals to identify attacker behaviour. Develop detection approaches using network telemetry such as NetFlow, Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), Transport Layer Security (TLS) metadata, and Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) telemetry. Correlate network activity with endpoint, cloud, identity, and email telemetry where applicable.

Detection Validation & Quality

Validate detections against attack simulations, threat scenarios, and real-world telemetry. Assess data quality and telemetry completeness across integrations. Continuously monitor detection performance and effectiveness. Identify gaps in attack coverage and recommend enhancements. Define and apply evaluation criteria for measuring detection efficacy. Test and tune detection content to ensure high-value and performant detections at scale.

Cross-Functional Collaboration

Collaborate with Integration Engineers, Product Managers, Detection Engineers, Threat Researchers, and Security Operations Center (SOC) teams. Work closely with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams. Provide requirements and feedback for new integrations to ensure detection-readiness. Help shape onboarding strategies for new vendors by identifying telemetry needed for meaningful security analytics. Influence normalization and data-modelling efforts to support scalable detection development. Convey advanced detection concepts and technical information to diverse stakeholders and audiences. Contribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.

WE'RE LOOKING FOR SOMEONE WITH EXPERIENCE IN:

• 6+ years of experience in Detection Engineering, Threat Hunting, Security Research, SOC Engineering, or Security Analytics.
• Expert-level Python expertise, with the ability to build detection tooling, automation, and frameworks.
• Deep understanding of diverse telemetry sources and their strengths and limitations, including: Endpoint: Windows Security and Sysmon logs, Linux auditd, macOS Unified Logs, and Endpoint Detection and Response (EDR) telemetry.
• Network: NetFlow, DNS, HTTP/TLS