Threat Intelligence Lead: Shape SaaS Security & Hunt

Obsidian-Security; Palo Alto (CA); On-site; USD 240,000 - 280,000; Full time

Benefits offered by this job

Annual conference budget

Equity and health benefits

401k

Flexible PTO

Parental leave

Job summary

Obsidian Security seeks a Threat Intelligence Lead to build and scale our threat intelligence and hunting function. Turn vast threat data into prioritized, actionable intelligence for product and corporate environments, and drive hunts across cloud, SaaS, and endpoint telemetry.

In a fast-growing startup, you’ll own intelligence requirements, collaborate with IT, Engineering, Product, and GRC, and contribute to purple team exercises while maturing detections and playbooks.

Qualifications

• 6+ years in threat intelligence, threat hunting, detection engineering, incident response, or security operations.
• Ability to analyze threat data and produce clear, prioritized assessments for varied audiences.
• Hands-on threat hunting across cloud, SaaS, and endpoint telemetry with MITRE ATT&CK knowledge.
• Familiarity with security capabilities and attack surfaces of modern IT/SaaS systems.

Responsibilities

• Collect, correlate, and synthesize threat intelligence from multiple sources into a single picture.
• Produce decision-grade intelligence products: advisories, actor profiles, and briefs.
• Run structured, hypothesis-driven threat hunts across corporate and product environments.
• Operationalize indicators into detections and drive enrichment of IOCs.
• Own intelligence requirements process and drive collection against defined needs.
• Contribute to purple team exercises and validate controls against intelligence.

Skills

Threat intelligence

Threat hunting

Detection engineering

Incident response

Security operations

MITRE ATT&CK

Python scripting

STIX/TAXII

Cloud/SaaS/endpoint telemetry

Tools

Python

SIEM query languages

STIX/TAXII

MISP/OpenCTI

Jira

Job description

Obsidian Security seeks a Threat Intelligence Lead to build and scale our threat intelligence and hunting function. Turn vast threat data into prioritized, actionable intelligence for product and corporate environments, and drive hunts across cloud, SaaS, and endpoint telemetry.

In a fast-growing startup, you’ll own intelligence requirements, collaborate with IT, Engineering, Product, and GRC, and contribute to purple team exercises while maturing detections and playbooks.