Senior Threat Intelligence Researcher

#RunwiththePack

At Arctic Wolf, we’re on a mission to end cyber risk. 

We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity. 

More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference. 

We’re constantly looking for talented people to join the Pack and help us take our performance to the next level. 

About the Position:

We are looking for a Senior Threat Intelligence Researcher to help achieve this mission.

The Senior Threat Intelligence Researcher will contribute to our Threat Intelligence organization by leading advanced cyber threat intelligence research and translating adversary insights into measurable defensive outcomes. This role focuses on deep technical analysis, adversary tracking, intelligence-driven detection, and operational collaboration to improve threat visibility, detection coverage, and incident response effectiveness across the organization.

As a senior technical authority, this role will shape intelligence methodologies, establish analytical standards, mentor peers, and deliver actionable intelligence that directly strengthens Arctic Wolf’s security operations and customer protection capabilities.

IN THIS ROLE, YOU WILL:

Threat Intelligence Research and Adversary Tracking

• Lead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.
• Own end-to-end cyber threat intelligence investigations, from initial research and hypothesis development through validation, reporting, and operational implementation.
• Conduct cyber threat intelligence research aligned with established frameworks such as the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model.
• Perform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.
• Investigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts.
• Apply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.
• Research Deep Web ecosystems, including crimeware-as-a-service and ransomware-as-a-service operations, to identify emerging threats, adversary relationships, and evolving attack methodologies.
• Analyze Windows and macOS internals, including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.
• Analyze and correlate large-scale datasets using Structured Query Language, Python, or Excel to identify patterns, generate actionable intelligence, and support evidence-based decisions.

Intelligence-to-Detection and Operational Impact

• Translate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata.
• Own the lifecycle of intelligence-driven detection improvements, from identifying intelligence gaps and developing detection hypotheses to validating coverage and measuring operational effectiveness.
• Take accountability for ensuring that intelligence findings are translated into practical defensive improvements rather than remaining limited to research reports or theoretical assessments.
• Develop intelligence-to-detection feedback loops that identify coverage gaps, assess detection effectiveness, and continuously improve defensive capabilities.
• Partner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, investigation, and response workflows.
• Provide escalation support for high-confidence threat events, including intelligence enrichment, attribution context, assessment of potential impact, and recommended response actions.
• Contribute real-time intelligence support during active incidents and investigations, ensuring findings are communicated promptly and translated into actionable recommendations.
• Support Request for Intelligence workflows by owning assigned requests from initial assessment through research, delivery, and follow-up, ensuring that outputs address the operational team's requirements.
• Evaluate the effectiveness of intelligence-led initiatives using measurable outcomes such as detection coverage, investigation efficiency, escalation quality, and response time improvements.

Automation, Scalability, and Analytical Excellence

• Develop automation and enrichment workflows using scripting languages such as Python to improve research efficiency, data quality, and intelligence delivery.
• Identify opportunities to eliminate repetitive manual activities and build scalable intelligence workflows that support growing operational requirements.
• Own the implementation and continuous improvement of assigned automation initiatives, ensuring they deliver measurable efficiency gains and remain reliable in production environments.
• Establish repeatable research methodologies, intelligence validation practices, and analytical standards to improve consistency, accuracy, and reproducibility.
• Analyze operational feedback, detection gaps, and intelligence quality metrics to identify improvement opportunities and prioritize initiatives based on their potential security impact.
• Create scalable intelligence dissemination methods, including threat alerts, intelligence briefs, technical reports, and knowledge base updates, ensuring that relevant teams receive timely and actionable information.

Collaboration, Technical Leadership, and Knowledge Sharing

• Collaborate with Detection Engineering, Threat Hunting, Incident Response, Security Operations Center, and Managed Detection and Response teams to align intelligence priorities with operational and customer security needs.
• Take ownership of assigned intelligence initiatives and drive them forward independently, coordinating with relevant stakeholders to resolve dependencies and achieve agreed outcomes.
• Provide technical guidance and mentorship to peers, share investigative techniques, and contribute to the development of technical standards within the research organization.
• Communicate complex technical findings clearly to technical and operational audiences, ensuring that recommendations are understood, actionable, and aligned with business priorities.
• Publish technical research, tradecraft methodologies, blogs, and whitepapers, or present findings at industry workshops and conferences.
• Stay informed about emerging adversary tactics, techniques, and procedures, assess their relevance to Arctic Wolf customers, and proactively recommend improvements to intelligence coverage and defensive capabilities.

YOU WILL BE SUCCESSFUL IN THIS ROLE IF:

• You have 5+ years of relevant experience and are recognized as a technical authority within one or more adversary ecosystems, such as ransomware, financially motivated crimeware, or nation-state operations.
• You have strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.
• You have hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.
• You have experience with malware analysis tooling, host telemetry, and network telemetry analysis.
• You possess strong knowledge of modern threat intelligence frameworks, analytical methodologies, and adversary research techniques.
• You demonstrate end-to-end ownership by independently driving investigations and intelligence initiatives from problem identification through execution, validation, and measurable outcomes.
• You can translate complex intelligence findings into actionable recommendations and demonstrate how your work improves detection coverage, investigation quality, or defensive capabilities.
• You take accountability for the quality, accuracy, timeliness, and operational relevance of your intelligence deliverables.
• You proactively identify gaps in intelligence coverage, investigative processes, and detection capabilities, and drive improvements without waiting for predefined instructions.
• You are comfortable working independently in ambiguous, fast-changing threat environments, making informed decisions, and adapting your approach as new evidence emerges.
• You have strong analytical, communication, and problem-solving skills, with the ability to explain technical findings and their operational implications.
• You have experience mentoring peers, sharing technical expertise, and contributing to research standards and best practices.
• You are passionate about improving intelligence-driven security operations and delivering measurable improvements to customer security outcomes.

NICE TO HAVE:

• Experience publishing threat research, whitepapers, or presenting at industry conferences.
• Experience collaborating with external intelligence-sharing communities or trusted industry partners.
• Experience building scalable threat intelligence workflows, enrichment pipelines, and operational frameworks.
• Familiarity with large-scale telemetry analysis and data science methodologies.
• Experience automating intelligence research, enrichment, and analysis workflows.
• Experience defining success metrics, measuring the effectiveness of intelligence-led initiatives, and using operational feedback to drive continuous improvement.
• Experience leading cross-functional initiatives and delivering outcomes in environments where requirements and priorities evolve rapidly.

WHAT SUCCESS LOOKS LIKE:

• Improved detection effectiveness: Intelligence-driven improvements result in measurable gains in detection coverage, detection quality, and operational visibility across Arctic Wolf security platforms.
• End-to-end ownership: Intelligence investigations and initiatives are driven from initial problem identification through actionable recommendations, operational implementation, and validation of results.
• Actionable intelligence: Research findings directly strengthen incident response, threat hunting, detection engineering, and defensive decision-making.
• Measurable operational impact: Intelligence-led enhancements contribute to reduced investigation and response times, improved escalation quality, and increased operational efficiency.
• Proactive threat identification: Emerging adversary tactics, infrastructure, and campaigns are identified and communicated in time to support appropriate defensive action.
• Scalable intelligence capabilities: Research methodologies, enrichment workflows, automation, and validation practices improve the consistency, reliability, and scalability of intelligence operations.
• Continuous improvement: Feedback from operational teams and intelligence consumers is used to identify gaps, refine analytical approaches, and strengthen defensive capabilities.
• Effective collaboration: Security Operations Center, Managed Detection and Response, Detection Engineering, and Incident Response teams receive timely, relevant intelligence that supports their operational objectives.
• Customer security outcomes: Intelligence research and operational improvements contribute to stronger customer protection, faster threat identification, and improved organizational resilience.

Do not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent.

Benefits

All wolves receive compelling compensation and benefits packages, including:  

• Equity for all employees 
• 18 days annual leave, flexible holidays & festivals, and paid volunteer days 
• Training and career development programs 
• Comprehensive private benefits plan including medical insurance for you and your family, life insurance (3x compensation), and personal accident insurance. 
• A modern workplace in Helios Business Park in Bengaluru

Security Requirements  

At Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security policies, standards, and controls designed to safeguard the confidentiality, integrity, and availability of business, customer, employee, and other confidential information and to support compliance with applicable legal and regulatory requirements.

Depending on the role and where permitted by applicable law, employment may be subject to background verification and additional regulatory, security, or compliance requirements, including obligations related to data protection and export control laws, and authorization requirements where applicable.

Your next big opportunity starts here — apply today and help us end cyber risk.