Senior Threat Researcher: Endpoint & Cloud Detections

Arctic Wolf; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Equity for all employees

Flexible annual leave

Career development programs

Private medical insurance

Paid parental leave

Job summary

Arctic Wolf is seeking a Senior Threat Researcher Endpoint/Cloud - Detections to help advance our Detection Engineering efforts. You will build high-quality detections across endpoint, cloud, and network environments, research emerging threats, and deliver actionable intelligence to protect customers.

The role emphasizes designing anomaly-based and behavioral-based detections, collaborating with teams, and contributing to secure software development practices.

Qualifications

• 6+ years authoring and maintaining security detections.
• Experience developing endpoint, cloud, or network detections.
• Experience in anomaly-based and behavioral-based detections.
• Knowledge of MITRE ATT&CK, threat intel sources, and packet capture.
• Proficient in Python, Go, Java, or C++ for detections.

Responsibilities

• Develop and maintain high-quality custom detection rules across endpoint, cloud, and network environments.
• Research emerging threats and telemetry sources to improve coverage and effectiveness.
• Design, develop, and improve anomaly-based and behavioral-based detections.
• Conduct code reviews to ensure quality, maintainability, and scalability.
• Troubleshoot, debug, and enhance existing detection and signature codebases.
• Collaborate across teams to build new detections and tune existing capabilities.

Skills

Threat detection engineering

Security research

Endpoint/Cloud detections

MITRE ATT&CK

Python/Go/Java/C++

Threat intel

Tools

Sigma

YARA

Zeek

Suricata

Kubernetes

Job description

Arctic Wolf is seeking a Senior Threat Researcher Endpoint/Cloud - Detections to help advance our Detection Engineering efforts. You will build high-quality detections across endpoint, cloud, and network environments, research emerging threats, and deliver actionable intelligence to protect customers.

The role emphasizes designing anomaly-based and behavioral-based detections, collaborating with teams, and contributing to secure software development practices.