Senior Threat Intelligence Researcher

sentinellabs; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Equity participation through RSUs and

Employee stock purchase plan

Competitive leave with gender-neutral

Medical and insurance coverage plus

Home office allowance, wellness, multi

Job summary

Sentinel Labs is seeking a Senior Threat Intelligence professional to lead advanced investigations into the evolving threat landscape, focusing on malware developments and adversary activity to keep defenses ahead of attackers. The role blends research, OSINT tradecraft, and analytical synthesis to inform executive decisions and shape detection capabilities.

You will triage OSINT signals, produce structured threat briefings for senior stakeholders, and collaborate with detection engineering to

Qualifications

• Experience in threat intelligence or threat hunting.
• Strong pattern recognition across large datasets.
• Proficiency in Python and SQL/NoSQL.
• Practical experience writing and validating YARA rules.
• Familiarity with MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP.

Responsibilities

• Triage OSINT signals from public sources and forums, evaluating fidelity and impact.
• Transform raw telemetry into structured threat briefings and risk assessments for leaders.
• Maintain and expand an internal knowledge base and IOC collection for detection/response.
• Monitor shifts in adversary tactics, techniques, procedures, and target selection across forums.
• Map threat actor footprints by reviewing domain registrations and DNS data.
• Partner with detection engineering to translate OSINT into hunting logic.
• Build and automate scrapers, monitors, and visualization tools for external telemetry.

Skills

Threat intelligence

Analytical thinking

Python

SQL

NoSQL databases

Tools

Python tooling

SQL databases

YARA rules

Job description

Role overview

Lead advanced investigations into the evolving threat landscape, watching malware developments and adversary activity to keep defenses ahead of attackers. The role combines deep-dive research, OSINT tradecraft, and analytical synthesis to produce intelligence that informs executive decisions and shapes detection capabilities.

Responsibilities

• Triage OSINT signals from public sources, dark web forums, and research repositories, evaluating fidelity and impact
• Transform raw external telemetry into structured threat briefings and risk assessments for senior stakeholders
• Maintain and expand an internal knowledge base and IOC collection supporting detection and response
• Monitor shifts in adversary tactics, techniques, procedures, recruitment patterns, and target selection across open and closed forums
• Pivot through domain registrations, SSL certificates, and passive DNS to map threat actor footprints
• Partner with detection engineering to convert validated OSINT findings into durable hunting logic
• Build and automate scrapers, monitors, and data-visualization tooling that surfaces anomalies in external telemetry

Requirements

• Background in threat intelligence or threat hunting with broad knowledge of threat actors and TTPs
• Strong analytical skills for identifying patterns and trends across large datasets
• Proficiency in Python and working knowledge of SQL and NoSQL databases
• Practical experience writing and validating YARA rules for new malware families
• Familiarity with MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP Galaxy frameworks

Nice to have

• Knowledge of malware analysis techniques including static and dynamic analysis, sandboxing, and debugging
• Technical writing and content development capability
• Understanding of software vulnerabilities and EDR internals
• Certifications such as CMA, CREA, or GIAC GREM

Benefits and work setup

• Equity participation through RSUs and an employee stock purchase plan
• Competitive leave with gender-neutral parental leave
• Medical and insurance coverage plus pension
• Home office allowance, wellness allowance, and a multi-sport benefit program