Threat Intelligence Engineer - Remote-Ready Detection Systems

Anthropic; Washington, San Francisco (District of Columbia, CA); Hybrid; USD 320,000 - 405,000; Full time

Job summary

Anthropic is seeking a Threat Intelligence Engineer to build scalable threat discovery infrastructure and data pipelines. You will integrate external data sources, develop detection systems for automated lead generation, and create internal tooling that scales investigators' impact.

This role offers a foundation on a small, high‑impact team; you will take projects from concept to production, working closely with investigators to understand needs and drive improvements in detection and enrichment

Qualifications

• Bachelor's degree in a relevant field or equivalent experience.
• Experience building detection logic, data pipelines, and automation using Python/SQL.
• Familiarity with threat intelligence concepts (IOCs, YARA, threat correlation).
• Experience integrating external APIs and building data ingestion systems.
• Ability to translate investigator needs into technical requirements.

Responsibilities

• Build automated detection systems that identify abusive behavior using disparate signals.
• Develop production-grade data pipelines with monitoring and logging.
• Create and maintain YARA rule infrastructure and testing tools.
• Integrate external threat intel platforms (VirusTotal, Censys, Urlscan) via MCP servers.
• Leverage data sources (RSS, CTI news) to generate targeted hunting queries.
• Develop behavioral analytics capabilities and audit logging infrastructure.
• Collaborate with investigators to tune detections and reduce false positives.
• Scrape and normalize data from external sources for detection workflows.

Skills

Python

SQL

Airflow

DBT

Threat intelligence

APIs

Data pipelines

Communication

Threat correlation

LLM automation

Education

Bachelor's degree

Tools

YARA

MCP servers

VirusTotal integration

Censys

Urlscan

MISP

STIX/TAXII

Job description

Anthropic is seeking a Threat Intelligence Engineer to build scalable threat discovery infrastructure and data pipelines. You will integrate external data sources, develop detection systems for automated lead generation, and create internal tooling that scales investigators' impact.

This role offers a foundation on a small, high‑impact team; you will take projects from concept to production, working closely with investigators to understand needs and drive improvements in detection and enrichment