Staff Threat Intelligence Researcher

Arctic Wolf; United States; Remote; USD 86,000 - 240,000; Full time

Benefits offered by this job

Equity for all employees

Flexible time off and volunteer days

401(k) contribution and matching

Training and career development

Job summary

Arctic Wolf is seeking a Staff Threat Intelligence Researcher to lead adversary investigations and develop durable detections across MDR and IR environments. You will correlate data from SIEM/EDR/cloud and craft actionable intelligence, hunting guidance, and customer protections.

The role demands deep knowledge of threat ecosystems, strong scripting skills, and the ability to communicate findings to technical and executive audiences. Remote-friendly with broad security operations impact.

Qualifications

• Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response or related discipline.
• Strong knowledge of nation-state, cybercriminal, ransomware, initial-access, malware, and vulnerability-exploitation ecosystems.
• Experience hunting across large-scale telemetry using SIEM/EDR/data-lake platforms and scripting languages.
• Ability to translate intelligence into detections, hunting strategies, or product improvements.
• Familiarity with MITRE ATT&CK, Diamond Model, and structured analytic techniques.

Responsibilities

• Lead rapid, intelligence-driven investigations into emerging threats and campaigns across a large telemetry environment.
• Develop defensible campaign and actor assessments and translate findings into detections and customer protections.
• Publish high-quality threat research and communicate findings to technical and executive audiences.
• Build repeatable research methods, tooling, and automation to reduce time from signal to finding.
• Collaborate with Adversary Response and Incident Response teams during active investigations.

Skills

Threat intelligence

Threat hunting

Malware analysis

Incident response

SQL

Python

Kusto

Sigma

YARA

Tools

SIEM

EDR

Data lake

Ghidra

IDA Pro

x64dbg

Job description

RunwiththePack At Arctic Wolf,

We’re on a mission to end cyber risk. We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity. More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference. We’re constantly looking for talented people to join the Pack and help us take our performance to the next level.

About the Position

The Staff Threat Intelligence Researcher is an expert individual contributor aligned closely with the Adversary Operations team. This role leads rapid, intelligence-driven investigations into emerging threats, active campaigns, and high-impact adversary activity, using internal managed detection and response (MDR), incident response (IR), endpoint, network, cloud, identity, malware, infrastructure, and open-source data. The researcher connects signals across customer environments, develops defensible campaign and actor assessments, and translates findings into timely hunting guidance, durable detections, incident response actions, customer protections, and authoritative reporting. Success is demonstrated through fast, technically rigorous investigations; discovery of previously unknown or under-scoped activity; and clear operational impact across security operations, incident response, product, and customer-facing teams.

Responsibilities

Recognized as a technical authority, the Staff Threat Intelligence Researcher independently leads complex adversary investigations and helps shape how the organization identifies, validates, tracks, and responds to emerging threats across a large, multi-customer telemetry environment. Lead rapid-response research into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity that may affect customers. Proactively hunt across internal MDR and IR telemetry to identify active campaigns, previously unknown infrastructure, malware, intrusion patterns, and common adversary behaviors across customer environments. Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source data to develop and test campaign hypotheses. Scope potentially widespread activity by determining affected customers, observed behaviors, intrusion timelines, infrastructure overlap, and confidence in campaign or actor clustering. Produce time-sensitive intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings during high-impact security events. Develop and operationalize YARA, Sigma, behavioral analytics, search logic, indicators, and detection hypotheses in partnership with detection engineering, threat hunting, and security operations teams. Partner closely with Adversary Response and Incident Response teams during active investigations, providing adversary context, collection requirements, analytical judgments, and follow-on hunting recommendations. Establish and apply rigorous standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation. Build repeatable research methods, tooling, and automation that reduce the time from initial signal to validated finding and customer protection. Publish high-quality internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums. Expert Positioning Goal Serve as a recognized authority in adversary research and response by developing repeatable campaign-investigation tradecraft, mentoring other researchers, and producing original research that improves customer protection and industry understanding of active threats.

Example Key Results

• Identified and scoped an active campaign through cross-customer MDR telemetry, enabling rapid customer notification, targeted hunting, and new behavioral detections.
• Reduced time from emerging-threat signal to validated intelligence package by creating reusable queries, enrichment workflows, and investigation playbooks.
• Established a defensible campaign-clustering and analytical-confidence approach used consistently in adversary reporting and response decisions.

Complexity & Problem Solving

Solves highly complex and ambiguous problems involving incomplete telemetry, noisy or deceptive indicators, uncertain attribution, multi-stage intrusions, and activity distributed across customer environments. Forms and tests competing hypotheses, distinguishes shared tooling from coordinated campaigns, assesses confidence and impact, and makes time-sensitive recommendations while identifying evidence gaps and alternative explanations.

About You

Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a related discipline, with demonstrated technical leadership as a senior individual contributor. Deep knowledge of nation-state, cybercriminal, ransomware, initial-access, malware, and vulnerability-exploitation ecosystems. Demonstrated experience hunting across large-scale endpoint, network, cloud, identity, email, and security-operations telemetry using SIEM, EDR, data-lake, or similar analysis platforms. Strong ability to use SQL, Python, Kusto Query Language, SPL, or comparable languages to analyze large datasets, automate enrichment, and build reusable research workflows. Experience analyzing host and network telemetry such as process execution, command lines, authentication events, DNS, proxy, firewall, Zeek, Sysmon, auditd, and cloud audit logs. Experience translating intelligence into YARA, Sigma, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements. Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence. Familiarity with malware-analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities. Proven ability to author publication-quality threat research and communicate technical findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences. Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or fast-moving security incidents.

On-Camera Policy

To support a fair, transparent, and engaging interview experience, candidates interviewing remotely are expected to be on camera during all video interviews. Being on camera fosters authentic connection, improves communication, and allows for full engagement from both candidates and interviewers. We understand that technical, bandwidth, or location-related challenges may occasionally prevent video use. If this applies, candidates are required to notify us in advance so we can explore appropriate accommodations.

Benefits

• Equity for all employees
• Flexible time off and paid volunteer days
• 401(k) contribution and matching
• Training and career development programs
• Comprehensive private benefits plan including medical, mental health, dental, disability, life and AD&D, and value-added services
• Robust Employee Assistance Program (EAP) with mental health services
• Fertility support and paid parental leave

Security Requirements

At Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security policies, standards, and controls designed to safeguard the confidentiality, integrity, and availability of business, customer, employee, and other confidential information and to support compliance with applicable legal and regulatory requirements. Depending on the role and where permitted by applicable law, employment may be subject to background verification and additional regulatory, security, or compliance requirements, including obligations related to data protection and export control laws, and authorization requirements where applicable.

Base Salary

The base salary range for this job family is 86,000 to 240,000 USD annually. This range reflects the base pay the company reasonably expects to offer for this position, aligned to the broader job family base pay structure. Actual base pay may vary based on skills, experience, and location, including job family level. In addition to base pay, Arctic Wolf offers variable incentive compensation, new hire equity grants, and a comprehensive benefits package.

We review all applications.

Arctic Wolf is an Equal Opportunity Employer.

We are committed to creating an inclusive and accessible workplace and providing reasonable accommodations, appropriate support throughout the hiring process and employment, in accordance with applicable local laws.

If you require support or adjustments during the recruitment process, please contact [e-mail].