Senior Threat Intelligence Researcher

sentinellabs; United States; Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

RSUs

Employee stock purchase plan

Gender-neutral parental leave

Medical insurance

Pension plan

Home office allowance

Wellness budget

Multi-sport program

Job summary

Sentinellabs is seeking a seasoned Threat Intelligence Analyst to lead investigations into the evolving threat landscape and translate findings into actionable detection capabilities. You will combine deep-dive research, OSINT tradecraft, and executive-ready synthesis to inform strategic decisions.

You will triage OSINT signals from public sources and forums, produce structured risk assessments, build hunting logic with detection engineering, and develop automated scrapers and data-visualization

Qualifications

• Background in threat intelligence or threat hunting.
• Strong analytical skills for identifying patterns in large datasets.
• Proficiency in Python and working knowledge of SQL and NoSQL.
• Experience writing and validating YARA rules.
• Familiarity with MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP Galaxy.

Responsibilities

• Triage OSINT signals from public sources and forums.
• Create structured threat briefings and risk assessments for executives.
• Maintain an internal knowledge base and IOC collection.
• Monitor adversary tactics and target selection across forums.
• Map threat actor footprints via domain registrations, SSL certs, passive DNS.
• Collaborate with detection engineering to turn OSINT into hunting logic.
• Build and automate scrapers, monitors, and data-visualization tooling.

Skills

Threat intelligence

Python

SQL

NoSQL

YARA rules

Data analysis

MITRE ATT&CK

Job description

Role overview

Lead advanced investigations into the evolving threat landscape, watching malware developments and adversary activity to keep defenses ahead of attackers. The role combines deep-dive research, OSINT tradecraft, and analytical synthesis to produce intelligence that informs executive decisions and shapes detection capabilities.

Responsibilities

• Triage OSINT signals from public sources, dark web forums, and research repositories, evaluating fidelity and impact
• Transform raw external telemetry into structured threat briefings and risk assessments for senior stakeholders
• Maintain and expand an internal knowledge base and IOC collection supporting detection and response
• Monitor shifts in adversary tactics, techniques, procedures, recruitment patterns, and target selection across open and closed forums
• Pivot through domain registrations, SSL certificates, and passive DNS to map threat actor footprints
• Partner with detection engineering to convert validated OSINT findings into durable hunting logic
• Build and automate scrapers, monitors, and data-visualization tooling that surfaces anomalies in external telemetry

Requirements

• Background in threat intelligence or threat hunting with broad knowledge of threat actors and TTPs
• Strong analytical skills for identifying patterns and trends across large datasets
• Proficiency in Python and working knowledge of SQL and NoSQL databases
• Practical experience writing and validating YARA rules for new malware families
• Familiarity with MITRE ATT&CK, CISA KEV, EPSS, AMITT, and MISP Galaxy frameworks

Nice to have

• Knowledge of malware analysis techniques including static and dynamic analysis, sandboxing, and debugging
• Technical writing and content development capability
• Understanding of software vulnerabilities and EDR internals
• Certifications such as CMA, CREA, or GIAC GREM

Benefits and work setup

• Equity participation through RSUs and an employee stock purchase plan
• Competitive leave with gender-neutral parental leave
• Medical and insurance coverage plus pension
• Home office allowance, wellness allowance, and a multi-sport benefit program