{"id":3373817,"url":"https://alion.io/job/arctic-wolf-senior-threat-intelligence-researcher","title":"Senior Threat Intelligence Researcher","company":{"id":1025,"name":"Arctic Wolf","domain":"arcticwolf.com","url":"https://alion.io/company/arctic-wolf","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":17,"ghost_share":0,"stale_share":0.353,"repost_share":0.118,"time_to_fill_p50_days":39,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":23000,"max_usd":49000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Diamond Model","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Suricata","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-10-27T00:00:00Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-11-05T00:21:34Z","board_verified":true,"closed_at":null,"days_open":9,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":9},"description":"#RunwiththePack\nAt Arctic Wolf, we’re on a mission to end cyber risk.\nWe are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity.\nMore than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.\nWe’re constantly looking for talented people to join the Pack and help us take our performance to the next level.\nAbout the Position:\nWe are looking for aSenior Threat Intelligence Researcher to help achieve this mission.\nThe Senior Threat Intelligence Researcher will contribute to our Threat Intelligence organization by leading advanced cyber threat intelligence research and translating adversary insights into measurable defensive outcomes. This role focuses on deep technical analysis, adversary tracking, intelligence-driven detection, and operational collaboration to improve threat visibility, detection coverage, and incident response effectiveness across the organization.\nAs a senior technical authority, this role will shape intelligence methodologies, establish analytical standards, mentor peers, and deliver actionable intelligence that directly strengthens Arctic Wolf’s security operations and customer protection capabilities.\nIN THIS ROLE, YOU WILL:\nThreat Intelligence Research and Adversary Tracking\nLead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.\nOwn end-to-end cyber threat intelligence investigations, from initial research and hypothesis development through validation, reporting, and operational implementation.\nConduct cyber threat intelligence research aligned with established frameworks such as the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model.\nPerform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.\nInvestigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts.\nApply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.\nResearch Deep Web ecosystems, including crimeware-as-a-service and ransomware-as-a-service operations, to identify emerging threats, adversary relationships, and evolving attack methodologies.\nAnalyze Windows and macOS internals, including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.\nAnalyze and correlate large-scale datasets using Structured Query Language, Python, or Excel to identify patterns, generate actionable intelligence, and support evidence-based decisions.\nIntelligence-to-Detection and Operational Impact\nTranslate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata.\nOwn the lifecycle of intelligence-driven detection improvements, from identifying intelligence gaps and developing detection hypotheses to validating coverage and measuring operational effectiveness.\nTake accountability for ensuring that intelligence findings are translated into practical defensive improvements rather than remaining limited to research reports or theoretical assessments.\nDevelop intelligence-to-detection feedback loops that identify coverage gaps, assess detection effectiveness, and continuously improve defensive capabilities.\nPartner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, investigation, and response workflows.\nProvide escalation support for high-confidence threat events, including intelligence enrichment, attribution context, assessment of potential impact, and recommended response actions.\nContribute real-time intelligence support during active incidents and investigations, ensuring findings are communicated promptly and translated into actionable recommendations.\nSupport Request for Intelligence workflows by owning assigned requests from initial assessment through research, delivery, and follow-up, ensuring that outputs address the operational team's requirements.\nEvaluate the effectiveness of intelligence-led initiatives using measurable outcomes such as detection coverage, investigation efficiency, escalation quality, and response time improvements.\nAutomation, Scalability, and Analytical Excellence\nDevelop automation and enrichment workflows using scripting languages such as Python to improve research efficiency, data quality, and intelligence delivery.\nIdentify opportunities to eliminate repetitive manual activities and build scalable intelligence workflows that support growing operational requirements.\nOwn the implementation and continuous improvement of assigned automation initiatives, ensuring they deliver measurable efficiency gains and remain reliable in production environments.\nEstablish repeatable research methodologies, intelligence validation practices, and analytical standards to improve consistency, accuracy, and reproducibility.\nAnalyze operational feedback, detection gaps, and intelligence quality metrics to identify improvement opportunities and prioritize initiatives based on their potential security impact.\nCreate scalable intelligence dissemination methods, including threat alerts, intelligence briefs, technical reports, and knowledge base updates, ensuring that relevant teams receive timely and actionable information.\nCollaboration, Technical Leadership, and Knowledge Sharing\nCollaborate with Detection Engineering, Threat Hunting, Incident Response, Security Operations Center, and Managed Detection and Response teams to align intelligence priorities with operational and customer security needs.\nTake ownership of assigned intelligence initiatives and drive them forward independently, coordinating with relevant stakeholders to resolve dependencies and achieve agreed outcomes.\nProvide technical guidance and mentorship to peers, share investigative techniques, and contribute to the development of technical standards within the research organization.\nCommunicate complex technical findings clearly to technical and operational audiences, ensuring that recommendations are understood, actionable, and aligned with business priorities.\nPublish technical research, tradecraft methodologies, blogs, and whitepapers, or present findings at industry workshops and conferences.\nStay informed about emerging adversary tactics, techniques, and procedures, assess their relevance to Arctic Wolf customers, and proactively recommend improvements to intelligence coverage and defensive capabilities.\nYOU WILL BE SUCCESSFUL IN THIS ROLE IF:\nYou have 5+ years of relevant experience and are recognized as a technical authority within one or more adversary ecosystems, such as ransomware, financially motivated crimeware, or nation-state operations.\nYou have strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.\nYou have hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.\nYou have experience with malware analysis tooling, host telemetry, and network telemetry analysis.\nYou possess strong knowledge of modern threat intelligence frameworks, analytical methodologies, and adversary research techniques.\nYou demonstrate end-to-end ownership by independently driving investigations and intelligence initiatives from problem identification through execution, validation, and measurable outcomes.\nYou can translate complex intelligence findings into actionable recommendations and demonstrate how your work improves detection coverage, investigation quality, or defensive capabilities.\nYou take accountability for the quality, accuracy, timeliness, and operational relevance of your intelligence deliverables.\nYou proactively identify gaps in intelligence coverage, investigative processes, and detection capabilities, and drive improvements without waiting for predefined instructions.\nYou are comfortable working independently in ambiguous, fast-changing threat environments, making informed decisions, and adapting your approach as new evidence emerges.\nYou have strong analytical, communication, and problem-solving skills, with the ability to explain technical findings and their operational implications.\nYou have experience mentoring peers, sharing technical expertise, and contributing to research standards and best practices.\nYou are passionate about improving intelligence-driven security operations and delivering measurable improvements to customer security outcomes.\nNICE TO HAVE:\nExperience publishing threat research, whitepapers, or presenting at industry conferences.\nExperience collaborating with external intelligence-sharing communities or trusted industry partners.\nExperience building scalable threat intelligence workflows, enrichment pipelines, and operational frameworks.\nFamiliarity with large-scale telemetry analysis and data science methodologies.\nExperience automating intelligence research, enrichment, and analysis workflows.\nExperience defining success metrics, measuring the effectiveness of intelligence-led initiatives, and using operational feedback to drive continuous improvement.\nExperience leading cross-functional initiatives and delivering outcomes in environments where requirements and priorities evolve rapidly.\nWHAT SUCCESS LOOKS LIKE:\nImproved detection effectiveness: Intelligence-driven improvements result in measurable gains in detection coverage, detection quality, and operational visibility across Arctic Wolf security platforms.\nEnd-to-end ownership: Intelligence investigations and initiatives are driven from initial problem identification through actionable recommendations, operational implementation, and validation of results.\nActionable intelligence: Research findings directly strengthen incident response, threat hunting, detection engineering, and defensive decision-making.\nMeasurable operational impact: Intelligence-led enhancements contribute to reduced investigation and response times, improved escalation quality, and increased operational efficiency.\nProactive threat identification: Emerging adversary tactics, infrastructure, and campaigns are identified and communicated in time to support appropriate defensive action.\nScalable intelligence capabilities: Research methodologies, enrichment workflows, automation, and validation practices improve the consistency, reliability, and scalability of intelligence operations.\nContinuous improvement: Feedback from operational teams and intelligence consumers is used to identify gaps, refine analytical approaches, and strengthen defensive capabilities.\nEffective collaboration: Security Operations Center, Managed Detection and Response, Detection Engineering, and Incident Response teams receive timely, relevant intelligence that supports their operational objectives.\nCustomer security outcomes: Intelligence research and operational improvements contribute to stronger customer protection, faster threat identification, and improved organizational resilience.\nDo not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent.\nBenefits\nAll wolves receive compelling compensation and benefits packages, including:\nEquity for all employees \n18 days annual leave, flexible holidays & festivals, and paid volunteer days \nTraining and career deve...","description_format":"text","description_chars":13109,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Health insurance","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Endpoint Security","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-28T02:06:31Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":8,"expected_fill_days":39,"reasons":["conf:1","velocity","win:early","comp:brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/arctic-wolf-senior-threat-intelligence-researcher","json_url":"https://alion.io/job/arctic-wolf-senior-threat-intelligence-researcher.json","meta":{"generated_at":"2026-11-05T01:37:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2054,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1025},"rest":"https://alion.io/mcp/rest/get_company?id=1025"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farctic-wolf-senior-threat-intelligence-researcher"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farctic-wolf-senior-threat-intelligence-researcher"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farctic-wolf-senior-threat-intelligence-researcher"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arctic-wolf-senior-threat-intelligence-researcher\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farctic-wolf-senior-threat-intelligence-researcher"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3373817}},{"tool":"search_jobs","arguments":{"company":"arcticwolf.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3373817},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}