SaaS Threat Intelligence Lead & Detection Architect

Obsidian; Palo Alto (CA); On-site; USD 240,000 - 280,000; Full time

Benefits offered by this job

Competitive salary

Equity

Annual conference budget

Professional development

Healthcare

Job summary

Obsidian Security, based in Palo Alto, CA, seeks a Threat Intelligence Lead to transform a flood of threat reporting into prioritized, actionable intelligence for our product and corporate environment. You will hunt threats, develop durable detections, and support incident investigations with attribution context.

The role requires hands‑on experience across cloud, SaaS, and endpoints, fluency in MITRE ATT&CK, and a passion for security.

Qualifications

• 6+ years in threat intelligence, threat hunting, detection engineering, incident response, or security operations.
• Ability to analyze threat data and produce prioritized, actionable assessments.
• Hands‑on threat hunting across cloud, SaaS, and endpoint telemetry with MITRE ATT&CK fluency.

Responsibilities

• Threat intelligence collection, correlation, and synthesis from multiple sources into a single picture.
• Assess threat applicability to Obsidian product and infrastructure and communicate relevance.
• Produce timely threat advisories, actor profiles, and leadership briefings.
• Track threat actors targeting SaaS and identity infra, mapping to MITRE ATT&CK.
• Own intelligence requirements and drive collection against them.
• Threat hunting and detection development with IOCs and TTPs.
• Operationalize detections and support incident investigations with attribution context.
• Contribute to purple team exercises and validate detection controls.
• Be customer zero of Obsidian product and provide feedback to shape workflows.

Skills

Threat intelligence

Threat hunting

Detection engineering

Incident response

Python scripting

MITRE ATT&CK

SIEM queries

STIX/TAXII

OpenCTI

Tools

Okta

Google Workspace

Salesforce

Slack

Notion

Jira

Job description

Obsidian Security, based in Palo Alto, CA, seeks a Threat Intelligence Lead to transform a flood of threat reporting into prioritized, actionable intelligence for our product and corporate environment. You will hunt threats, develop durable detections, and support incident investigations with attribution context.

The role requires hands‑on experience across cloud, SaaS, and endpoints, fluency in MITRE ATT&CK, and a passion for security.