{"id":2849273,"url":"https://alion.io/job/arctic-wolf-threat-researcher-cloud-endpoint-detection","title":"Threat Researcher -Cloud & Endpoint Detection","company":{"id":1025,"name":"Arctic Wolf","domain":"arcticwolf.com","url":"https://alion.io/company/arctic-wolf","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":18,"ghost_share":0,"stale_share":0.389,"repost_share":0.056,"time_to_fill_p50_days":39,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17500,"max_usd":41000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":774},"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Amazon Aurora","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Okta","optional":false},{"name":"Python","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"Suricata","optional":false},{"name":"Sysmon","optional":false},{"name":"Windows","optional":false},{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-09-30T00:00:00Z","employer_posted_date":"2026-09-30","last_verified_at":"2026-10-23T19:05:25Z","board_verified":true,"closed_at":null,"days_open":23,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":23},"description":"At Arctic Wolf, you will not just watch the cybersecurity industry evolve - you will help lead the change. Our global team is made up of people who thrive on solving complex problems, moving quickly, and building technology that protects organizations around the world. We are proud to be recognized by Forbes, CNBC, Fortune, CRN, Gartner Peer Insights, and International Data Corporation MarketScape. What matters most is the work behind these recognitions: delivering real outcomes for customers through award-winning innovation such as our Aurora Platform.\nIf you are looking for meaningful work, smart teammates, and the opportunity to make a real impact in a high-growth company that is redefining security operations, Arctic Wolf is the right place for you.\nOur mission is simple: End Cyber Risk.\nWe are looking for aThreat Researcher - Cloud & Endpoint Detection to join our Integrations Team and help achieve this mission.\nYou'll be working as a Detection Engineer within Integrations, Detection, & Response (IDR), reporting directly to the Manager of Detection Engineering, XDR while working closely with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams.\nThis individual will be responsible for providing technical direction to deliver high-value, performant, generalized detections across many telemetry sources - endpoint, network, cloud, identity, and email - to provide broad Extended Detection and Response (XDR) coverage for customers. They will provide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale.\nThis role sits at the intersection of security research, detection engineering, and integrations. The primary responsibility is to analyse data ingested from integrated security providers and transform that telemetry into actionable detection rules, correlation logic, and attack coverage. Initially, the role will focus heavily on detections powered by data from third-party integrations, with opportunities to expand coverage across cloud, identity, endpoint, and Software as a Service (SaaS) ecosystems as new integrations are onboarded.\nThe ideal candidate has a strong understanding of attacker behaviour, security telemetry, and detection engineering, with the ability to quickly learn new vendor schemas, Application Programming Interfaces (APIs), and event models to identify meaningful detection opportunities.\nIN THIS ROLE, YOU WILL:\nThird-Party Integration Detection Development\nServe as a detection subject matter expert within the Integrations Team.\nApply broad expertise and knowledge across multiple telemetry domains, including endpoint, network, cloud, identity, and email, to design detections that generalize across diverse customer environments.\nContribute to the development of detection strategies and principles to achieve coverage goals in creative and effective ways.\nProduce detection specifications and coverage models and determine operational feasibility.\nDevelop detections, correlation rules, and analytics based on telemetry ingested from third-party integrations.\nAnalyse vendor APIs, audit logs, alerts, and event schemas to identify security detection opportunities.\nDesign detection coverage that leverages data from integrated security products, cloud providers, identity platforms, email security solutions, and endpoint security tools.\nPartner closely with integration engineers to understand newly onboarded data sources and maximize security value from collected telemetry.\nProvide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale.\nDetection Research\nResearch emerging threats, attack techniques, and adversary tactics.\nWork on significant and unique detection challenges where analysis of attacker behaviour requires evaluation of complex, cross-domain signal correlation.\nApply conceptual thinking to understand advanced threats, novel attack chains, and their implications across telemetry boundaries.\nIdentify opportunities to detect malicious activity using third-party security and SaaS telemetry.\nMap detections to the MITRE ATT&CK framework and maintain alignment with evolving threat landscapes.\nContinuously improve existing detections by reducing false positives and increasing attack coverage.\nExercise independent judgment in detection methodology, technique selection, and evaluation criteria for measuring detection efficacy.\nProvide thought leadership on cross-telemetry detection approaches and contribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.\nSecurity Domain Coverage- Develop detections across multiple security domains, including:\nIdentity & Access Security\nAccount takeover\nMFA abuse and bypass\nPrivilege escalation\nSuspicious administrative activity\nService account misuse\nOAuth and application abuse\nEmail Security\nBusiness Email Compromise (BEC)\nPhishing campaigns\nMalicious attachment activity\nEmail forwarding rule creation\nSuspicious mailbox access\nAbnormal email behaviours\nEndpoint Security\nMalware and ransomware activity\nCredential theft techniques\nSuspicious process execution\nPersistence mechanisms\nLateral movement\nDefence evasion\nLiving-off-the-land techniques\nEndpoint compromise indicators\nCloud Security\nExcessive permission changes\nSuspicious cloud administration activity\nData exfiltration attempts\nResource misconfigurations\nCloud account abuse\nWorkload compromise activity\nNetwork Security\nAnalyse network telemetry and cross-domain signals to identify attacker behaviour.\nDevelop detection approaches using network telemetry such as NetFlow, Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), Transport Layer Security (TLS) metadata, and Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) telemetry.\nCorrelate network activity with endpoint, cloud, identity, and email telemetry where applicable.\nDetection Validation & Quality\nValidate detections against attack simulations, threat scenarios, and real-world telemetry.\nAssess data quality and telemetry completeness across integrations.\nContinuously monitor detection performance and effectiveness.\nIdentify gaps in attack coverage and recommend enhancements.\nDefine and apply evaluation criteria for measuring detection efficacy.\nTest and tune detection content to ensure high-value and performant detections at scale.\nCross-Functional Collaboration\nCollaborate with Integration Engineers, Product Managers, Detection Engineers, Threat Researchers, and Security Operations Center (SOC) teams.\nWork closely with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams.\nProvide requirements and feedback for new integrations to ensure detection-readiness.\nHelp shape onboarding strategies for new vendors by identifying telemetry needed for meaningful security analytics.\nInfluence normalization and data-modelling efforts to support scalable detection development.\nConvey advanced detection concepts and technical information to diverse stakeholders and audiences.\nContribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.\nWE'RE LOOKING FOR SOMEONE WITH EXPERIENCE IN:\n4+ years of experience in Detection Engineering, Threat Hunting, Security Research, SOC Engineering, or Security Analytics.\nExpert-level Python expertise, with the ability to build detection tooling, automation, and frameworks.\nDeep understanding of diverse telemetry sources and their strengths and limitations, including: Endpoint: Windows Security and Sysmon logs, Linux auditd, macOS Unified Logs, and Endpoint Detection and Response (EDR) telemetry. Network: NetFlow, DNS, HTTP/TLS metadata, and IDS/IPS such as Suricata. Cloud: Amazon Web Services (AWS) CloudTrail, Azure Activity Logs, Google Cloud Platform (GCP) Audit Logs, and Kubernetes audit logs. Identity: Identity Provider (IdP) logs such as Okta and Azure Active Directory/Entra ID, authentication, and authorization events. Email: Mail flow logs, phishing indicators, and header analysis.\nExperience building detections using telemetry from cloud, endpoint, identity, email, or security platforms.\nAbility to analyse new third-party integrations, understand vendor-specific schemas and APIs, and rapidly develop detection coverage from ingested telemetry.\nHands-on experience with one or more detection technologies such as Kusto Query Language (KQL), Splunk Processing Language (SPL), Sigma, Structured Query Language (SQL), or equivalent analytics languages.\nStrong understanding of security telemetry, event correlation, and detection tuning.\nExperience working with data from security products, cloud platforms, identity providers, or SaaS applications.\nFamiliarity with endpoint, identity, cloud, network, and email security telemetry.\nAbility to analyse unfamiliar security event schemas and rapidly build detections from new data sources.\nGood understanding of adversary tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK framework.\nExperience designing detection strategies, coverage models, and detection specifications.\nAbility to evaluate detection effectiveness and identify opportunities to improve attack coverage.\nExperience providing technical guidance, mentoring, or direction to other detection engineers or developers.\nNICE TO HAVE:\nExperience with Security Information and Event Management (SIEM), Extended Detection and Response (XDR), Managed Detection and Response (MDR), Cloud Native Application Protection Platform (CNAPP), or Identity Threat Detection platforms.\nFamiliarity with security data normalization frameworks such as Open Cybersecurity Schema Framework (OCSF).\nExperience working across multiple telemetry domains and developing cross-domain or generalized detection approaches.\nExperience with attack simulation and detection validation.\nExperience working with third-party security integrations and vendor-specific data models.\nExperience with XDR detection programs or large-scale detection content development.\nIDEAL CANDIDATE PROFILE\nThe ideal candidate is passionate about turning third-party security telemetry into actionable detections. They are comfortable diving into a newly onboarded integration, understanding the data model, identifying attacker-relevant events, and rapidly developing detection coverage.\nThey bring broad expertise across endpoint, network, cloud, identity, and email telemetry and are able to think beyond individual data sources to identify complex attack chains and cross-domain detection opportunities.\nThey are also comfortable providing technical direction to other detection engineers and developers, contributing to detection strategy, and influencing how detection content is designed, tested, evaluated, and scaled across the XDR ecosystem.\nSuccess in this role will be measured by the ability to maximize security value from integrated data sources and deliver meaningful detection coverage across the growing integration ecosystem.\nThis role is ideal for professionals from Detection Engineering, Security Research, SOC Content Development, XDR Detection Teams, Endpoint Detection Engineering, or CNAPP Security Teams who are passionate about understanding attacker behaviour and transforming security telemetry from cloud, endpoint, identity, email, network, and third-party security integrations into actionable detections at scale.\nDo not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent.\nOn-Camera Policy\nTo support a fair, transparent, and engaging interview experience, candidates interviewing remotely are expected to be on camera during all video interviews. Being on camera fosters authentic connection, improves communication, and allows for full engagement from both candidates and interviewers. We understand that technical, bandwidth, or location-related challenges may occasi...","description_format":"text","description_chars":14648,"description_truncated":true,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Equity","Health insurance","Life insurance","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-19T12:31:27Z"}],"visa":[],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.826,"p_room":0.9,"age_days":23,"expected_fill_days":39,"reasons":["conf:1","velocity","win:mid","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/arctic-wolf-threat-researcher-cloud-endpoint-detection","json_url":"https://alion.io/job/arctic-wolf-threat-researcher-cloud-endpoint-detection.json","meta":{"generated_at":"2026-10-23T22:02:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4569,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1025},"rest":"https://alion.io/mcp/rest/get_company?id=1025"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farctic-wolf-threat-researcher-cloud-endpoint-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farctic-wolf-threat-researcher-cloud-endpoint-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farctic-wolf-threat-researcher-cloud-endpoint-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arctic-wolf-threat-researcher-cloud-endpoint-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farctic-wolf-threat-researcher-cloud-endpoint-detection"}]}