Threat Intelligence Lead

Obsidian; Palo Alto (CA); On-site; USD 240,000 - 280,000; Full time

Benefits offered by this job

Competitive salary

Equity

Annual conference budget

Professional development

Healthcare

Job summary

Obsidian Security, based in Palo Alto, CA, seeks a Threat Intelligence Lead to transform a flood of threat reporting into prioritized, actionable intelligence for our product and corporate environment. You will hunt threats, develop durable detections, and support incident investigations with attribution context.

The role requires hands‑on experience across cloud, SaaS, and endpoints, fluency in MITRE ATT&CK, and a passion for security.

Qualifications

• 6+ years in threat intelligence, threat hunting, detection engineering, incident response, or security operations.
• Ability to analyze threat data and produce prioritized, actionable assessments.
• Hands‑on threat hunting across cloud, SaaS, and endpoint telemetry with MITRE ATT&CK fluency.

Responsibilities

• Threat intelligence collection, correlation, and synthesis from multiple sources into a single picture.
• Assess threat applicability to Obsidian product and infrastructure and communicate relevance.
• Produce timely threat advisories, actor profiles, and leadership briefings.
• Track threat actors targeting SaaS and identity infra, mapping to MITRE ATT&CK.
• Own intelligence requirements and drive collection against them.
• Threat hunting and detection development with IOCs and TTPs.
• Operationalize detections and support incident investigations with attribution context.
• Contribute to purple team exercises and validate detection controls.
• Be customer zero of Obsidian product and provide feedback to shape workflows.

Skills

Threat intelligence

Threat hunting

Detection engineering

Incident response

Python scripting

MITRE ATT&CK

SIEM queries

STIX/TAXII

OpenCTI

Tools

Okta

Google Workspace

Salesforce

Slack

Notion

Jira

Job description

Obsidian Security is the leading SaaS security platform, trusted by global enterprises like Snowflake, T‑Mobile, and Algolia. We protect 200+ organizations across North America, Europe, the Middle East, Southeast Asia, Australia, and New Zealand, including many of the world’s largest Fortune 1000 and Global 2000 companies. Founded in 2017 and backed by top investors like Greylock, Obsidian was built to close a critical gap: securing SaaS apps where business happens—Microsoft 365, Salesforce, and hundreds more. The company does this by offering a complete SaaS security platform to reduce risk, detect and respond to threats, and prevent breaches at the source.

Obsidian was built by leaders who redefined endpoint and identity security at CrowdStrike, Okta, Cylance, and Carbon Black. Now, they’re transforming how SaaS is secured. With AI driving rapid SaaS growth and complexity, agentic AI tools gain privileged access to sensitive data through integrations, creating new risks most security tools miss. Obsidian uniquely detects anomalous OAuth token activity and manages integration risks. Major announcements are on the horizon. Recognizing that SaaS security needs to evolve, Obsidian enables growing organizations to start with a lightweight, prevention‑focused browser extension and expand coverage over time. With global momentum, a growing partner ecosystem including SentinelOne, Databricks, and Google Cloud, and a major fundraise ahead, Obsidian is scaling rapidly toward long‑term growth and IPO readiness.

We’re looking for a Threat Intelligence Lead to join our team and build the function that tells Obsidian what threats matter, why, and what we do about them. The ideal candidate for the role will be a highly technical, passionate, team‑oriented professional who can turn a noisy flood of external threat reporting into prioritized, actionable intelligence for both our product and our corporate environment — and then go hunt for it in our own telemetry. The ideal person for this role must be mission and values‑driven, must have an ownership mentality, and must put the well‑being of our customers, our teammates, and our organization at the forefront of how they operate. This person must be able to operate and thrive in a dynamic, high‑growth startup environment within a young and growing Security, GRC, and IT team and programs. This is a critical, high‑impact role that will serve as a catalyst for growth for any seasoned cybersecurity professional.

Your Responsibilities Will Include:

Threat Intelligence Collect, correlate, and synthesize threat intelligence from commercial feeds, open source reporting, ISACs, vendor advisories, researcher communities, and dark web sources into a single coherent picture. Assess the applicability of each emerging threat, campaign, and vulnerability to the Obsidian product and to Obsidian's corporate infrastructure — and say clearly whether it matters to us and why. Produce timely, decision‑grade intelligence products: threat advisories, actor and campaign profiles, and periodic briefings for both technical teams and leadership. Track threat actors targeting SaaS, cloud, and identity infrastructure, and maintain a living view of the TTPs most relevant to our customers and to us, mapped to MITRE ATT&CK. Own the intelligence requirements process — define what we need to know, and drive collection against it rather than reacting to whatever crosses the wire. Threat Hunting and Detection Run structured, hypothesis‑driven threat hunts across corporate and product environments based on IOCs, TTPs, and intelligence‑derived leads. Operationalize indicators into detections, and drive the enrichment and lifecycle management of IOCs so they stay useful instead of stale. Write and tune the detections yourself — convert hunt findings into durable detection logic, playbooks, and response actions, and partner with incident response to operationalize them. Support incident investigations with attribution context, actor tradecraft, and pivoting off known infrastructure. Contribute to purple team exercises and validate that our controls actually detect what the intelligence says we should care about. Customer Zero Be the customer zero of the Obsidian product — use it at full capability to secure our own corporate assets, run hunts inside it, and pressure‑test it the way our most demanding customers do. Identify use‑cases to address, provide feedback on in‑development features, and reshape workflows in the product.

What We're Looking For

A person who is excited about working at an industry‑leading cybersecurity startup operating at the cutting edge of the field, defending against state‑of‑the‑art threats. At least 6 years of experience in threat intelligence, threat hunting, detection engineering, incident response, or security operations. Level commensurate with experience. Demonstrated ability to analyze threat data and produce clear, prioritized, actionable assessments for varied audiences. Hands‑on threat hunting experience across cloud, SaaS, and endpoint telemetry, with fluency in MITRE ATT&CK and the intelligence lifecycle. Working knowledge of the security capabilities and attack surface of modern IT and SaaS systems such as Okta, Google Workspace, Salesforce, Slack, Notion, and Jira. Experience with SIEM query languages and with scripting for automation and enrichment in a language such as Python. Familiarity with intelligence sharing standards and tooling (STIX/TAXII, MISP, OpenCTI, or similar). Be obsessive about security while doing everything possible to support the overall mission.

What We Can Do For You

• Be part of a team‑first, low‑ego, mission‑focused culture.
• Provide opportunities for professional development.
• Provide opportunities to make high‑impact contributions to security.
• Provide opportunities to influence the Obsidian product.
• Annual conference attendance budget.
• Competitive salary, equity, and health benefits.
• Opportunity to publish research, share non‑proprietary code, and present at conferences.
• Reserve your seat on our rocket ship!
• We are funded by Greylock Partners, Google Ventures, Menlo Ventures, WingVC, Norwest Venture Partners, Crescent Cove Advisors, and are growing fast.

Employee Benefits

• Competitive compensation with equity and 401k
• Comprehensive healthcare with dental and vision coverage
• Flexible paid time off and paid holiday time off
• 12 weeks of new parent or family leave
• Personal and professional development resources

Pay Transparancy

Please note that the base pay range is a guideline and for candidates who receive an offer, the base pay will vary based on factors such as work location, as well as the knowledge, skills and experience of the candidate. In addition to a competitive base salary, this position is eligible for equity awards and may be eligible for sales commission or incentive compensation based on the role or function within the company.

At Obsidian, we are proud to be an equal‑opportunity employer. We value diversity and hire for talent, passion, and compassion. In compliance with federal law, all persons hired will be required to submit satisfactory proof of identity and legal authorization.

If you have a need that requires accommodation, please contact [e-mail] Information collected and processed as part of any job applications you choose to submit is subject to Obsidian’s Applicant Privacy Policy.

Base Salary Range $240,000 — $280,000 USD