{"id":1972700,"url":"https://alion.io/job/arctic-wolf-threat-intelligence-researcher-2","title":"Threat Intelligence Researcher","company":{"id":1025,"name":"Arctic Wolf","domain":"arcticwolf.com","url":"https://alion.io/company/arctic-wolf","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":18,"ghost_share":0,"stale_share":0.389,"repost_share":0.056,"time_to_fill_p50_days":39,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17500,"max_usd":42000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":774},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Diamond Model","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Suricata","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false}],"status":"live","first_seen_at":"2026-10-06T19:57:50Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-23T04:49:51Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"At Arctic Wolf, you will not just watch the cybersecurity industry evolve - you will help lead the change. Our global team is made up of people who thrive on solving complex problems, moving quickly, and building technology that protects organizations around the world. We are proud to be recognized by Forbes, CNBC, Fortune, CRN, Gartner Peer Insights, and International Data Corporation MarketScape. What matters most is the work behind these recognitions: delivering real outcomes for customers through award-winning innovation such as our Aurora Platform.\nIf you are looking for meaningful work, smart teammates, and the opportunity to make a real impact in a high-growth company that is redefining security operations, Arctic Wolf is the right place for you.\nOur mission is simple: End Cyber Risk.\nWe are looking for aThreat Intelligence Researcher to help achieve this mission.\nThe Threat Intelligence Researcher will contribute to our Threat Intelligence organization by leading advanced cyber threat intelligence research and translating adversary insights into measurable defensive outcomes. This role focuses on deep technical analysis, adversary tracking, intelligence-driven detection, and operational collaboration to improve threat visibility, detection coverage, and incident response effectiveness across the organization.\nAs a senior technical authority, this role will shape intelligence methodologies, establish analytical standards, mentor peers, and deliver actionable intelligence that directly strengthens Arctic Wolf’s security operations and customer protection capabilities.\nIN THIS ROLE, YOU WILL:\nLead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft\nConduct end-to-end cyber threat intelligence research aligned with established frameworks such as the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model\nPerform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms\nInvestigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts\nTranslate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata\nAnalyze Windows or macOS internals including application programming interfaces, obfuscation techniques, system calls, and execution behaviors\nApply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources\nResearch Deep Web ecosystems including crimeware-as-a-service and ransomware-as-a-service operations\nAnalyze and correlate large-scale datasets using technologies such as Structured Query Language, Python, or Excel to extract actionable intelligence insights\nDevelop automation and enrichment workflows using scripting languages such as Python\nPartner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, and response workflows\nSupport Request for Intelligence workflows by delivering timely and actionable intelligence to operational teams\nProvide escalation support for high-confidence threat events, including enrichment, attribution context, and recommended response actions\nContribute real-time intelligence support during active incidents and investigations\nDevelop intelligence-to-detection feedback loops that improve coverage and operational visibility\nCreate scalable intelligence dissemination methods including alerts, intelligence briefs, and knowledge base updates\nStandardize analytical frameworks, intelligence validation practices, and operational research methodologies\nPublish technical research, tradecraft methodologies, blogs, whitepapers, or present at industry workshops and conferences\nYOU WILL BE SUCCESSFUL IN THIS ROLE IF:\nYou have 3+ years of relevant experience and you are recognized as a technical authority within one or more adversary ecosystems such as ransomware, financially motivated crimeware, or nation-state operations\nYou have strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis\nYou have hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling\nYou have experience with malware analysis tooling, host telemetry, and network telemetry analysis\nYou possess strong knowledge of modern threat intelligence frameworks and methodologies\nYou have experience translating intelligence into measurable operational outcomes and defensive improvements\nYou are comfortable working independently within highly ambiguous and rapidly evolving threat environments\nYou have strong analytical, communication, and problem-solving skills\nYou have experience mentoring peers and shaping technical standards within research organizations\nYou are passionate about improving intelligence-driven security operations and defensive capabilities\nNice to have:\nExperience publishing threat research, whitepapers, or presenting at industry conferences\nExperience collaborating with external intelligence-sharing communities or trusted industry partners\nExperience building scalable threat intelligence workflows and operational frameworks\nFamiliarity with large-scale telemetry analysis and data science methodologies\nExperience automating intelligence workflows and enrichment pipelines\nWHAT SUCCESS LOOKS LIKE:\nImproved detection effectiveness and operational visibility across Arctic Wolf security platforms\nActionable intelligence that directly strengthens incident response, threat hunting, and detection engineering outcomes\nMeasurable improvements in detection coverage and escalation quality through intelligence-led enhancements\nReduced response times and increased operational efficiency for threat intelligence support workflows\nDevelopment of scalable methodologies, analytical standards, and intelligence validation practices\nHigh-confidence intelligence reporting that improves customer security outcomes and organizational threat awareness\nDo not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent.\nOn-Camera Policy\nTo support a fair, transparent, and engaging interview experience, candidates interviewing remotely are expected to be on camera during all video interviews. Being on camera fosters authentic connection, improves communication, and allows for full engagement from both candidates and interviewers. We understand that technical, bandwidth, or location-related challenges may occasionally prevent video use. If this applies, candidates are required to notify us in advance so we can explore appropriate accommodations.\nAt Arctic Wolf, we foster a collaborative and inclusive work environment that thrives on diversity of thought, background, and culture. This is reflected in our multiple awards, including Top Workplace United States, Best Places to Work United States, Great Place to Work Canada, Great Place to Work United Kingdom, and Kununu Top Company Germany. Our commitment to bold growth and shaping the future of security operations is matched by our dedication to customer satisfaction, with over 10,000 customers worldwide and more than 2,000 channel partners globally. As we continue to expand and enhance our technology, Arctic Wolf remains a trusted name in the industry.\nOur Values\nArctic Wolf recognizes that success comes from delighting our customers, so we work together to ensure that happens every day. We believe in diversity and inclusion and value the unique perspectives all employees bring to the organization. By protecting sensitive data and working to end cyber risk, we contribute to an industry that serves the greater good.\nWe celebrate diverse perspectives through our Pack Unity program and encourage employees to participate in or create new alliances.\nWe also believe in corporate responsibility and have joined the Pledge One Percent movement to give back to our communities.\nAll employees receive compelling compensation and benefits packages, including:\nEquity for all employees\nFlexible annual leave, paid holidays, and volunteer days\nTraining and career development programs\nComprehensive private benefits plan including medical insurance for you and your family, life insurance equal to three times compensation, and personal accident insurance\nFertility support and paid parental leave\nArctic Wolf is an equal opportunity employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under applicable law. We are committed to fostering a welcoming, accessible, and inclusive environment.\nSecurity Requirements\nConduct duties in accordance with Arctic Wolf information security policies, standards, and controls\nBackground checks are required for this position\nThis role may require access to information protected under United States export control laws and regulations","description_format":"text","description_chars":9254,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Health insurance","Life insurance","Parental leave"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Information Security","Information Technology","Endpoint Security"],"lifecycle":[{"event":"open","at":"2026-10-06T19:57:50Z"}],"visa":[],"liveness":{"score":77,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.859,"p_room":0.9,"age_days":16,"expected_fill_days":39,"reasons":["conf:1","velocity","win:mid","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/arctic-wolf-threat-intelligence-researcher-2","json_url":"https://alion.io/job/arctic-wolf-threat-intelligence-researcher-2.json","meta":{"generated_at":"2026-10-23T10:11:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15514,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1025},"rest":"https://alion.io/mcp/rest/get_company?id=1025"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farctic-wolf-threat-intelligence-researcher-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farctic-wolf-threat-intelligence-researcher-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farctic-wolf-threat-intelligence-researcher-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arctic-wolf-threat-intelligence-researcher-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farctic-wolf-threat-intelligence-researcher-2"}]}