Threat Intelligence Engineer: AI Security and Hunting

Anthropic Limited; San Francisco (CA); Hybrid; USD 320,000 - 405,000; Full time

Job summary

Anthropic is seeking a Threat Intelligence Engineer to produce actionable intelligence that drives detections, hunts, and defensive priorities. You will track adversaries targeting frontier AI labs, build tooling and pipelines, and work with detection engineers and incident responders to ensure intelligence informs outcomes.

The role requires hands-on CTI, strong engineering, and experience turning intelligence into durable detections. Hybrid in-office policy applies; remote work not guaranteed.

Qualifications

• 5+ years of hands-on cyber threat intelligence, threat hunting, or intrusion analysis at a sophisticated organization.
• Strong engineering: production-quality Python and automation to run data pipelines.
• Experience analyzing malware, phishing infrastructure, and attacker tooling.
• Experience authoring detection logic (YARA, Sigma, Snort/Suricata) and durable detections.

Responsibilities

• Research, track, and report on threat actors and campaigns targeting AI labs and tech sector.
• Build and maintain tooling to collect, enrich, and operationalize indicators of compromise.
• Develop intelligence-driven threat hunts across endpoints, cloud, identity, and SaaS telemetry.
• Translate intelligence into detection rules, hunting hypotheses, and incident context.
• Collaborate with Detection Engineering and Incident Response to inform defenses.
• Contribute to threat models and risk assessments for the enterprise.
• Build external intelligence-sharing relationships with peers and government partners.

Skills

Threat intelligence

Threat hunting

Python

Automation

Data pipelines

Detection engineering

Incident response

Clear writing

Education

Bachelor’s degree in a relevant field

Tools

YARA

Sigma

Snort/Suricata

SIEM queries

AWS

GCP

Kubernetes

Job description

Anthropic is seeking a Threat Intelligence Engineer to produce actionable intelligence that drives detections, hunts, and defensive priorities. You will track adversaries targeting frontier AI labs, build tooling and pipelines, and work with detection engineers and incident responders to ensure intelligence informs outcomes.

The role requires hands-on CTI, strong engineering, and experience turning intelligence into durable detections. Hybrid in-office policy applies; remote work not guaranteed.