Senior Threat Intelligence Researcher

#RunwiththePack

At Arctic Wolf, we’re on a mission to end cyber risk .

We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity.

More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.

We’re constantly looking for talented people to join the Pack and help us take our performance to the next level.

About the Position:

We are looking for a Senior Threat Intelligence Researcher to help achieve this mission.

The Senior Threat Intelligence Researcher will contribute to our Threat Intelligence organization by leading advanced cyber threat intelligence research and translating adversary insights into measurable defensive outcomes. This role focuses on deep technical analysis, adversary tracking, intelligence-driven detection, and operational collaboration to improve threat visibility, detection coverage, and incident response effectiveness across the organization.

As a senior technical authority, this role will shape intelligence methodologies, establish analytical standards, mentor peers, and deliver actionable intelligence that directly strengthens Arctic Wolf’s security operations and customer protection capabilities.

IN THIS ROLE, YOU WILL:

Threat Intelligence Research and Adversary Tracking

• •Lead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.
• •Own end-to-end cyber threat intelligence investigations, from initial research and hypothesis development through validation, reporting, and operational implementation.
• •Conduct cyber threat intelligence research aligned with established frameworks such as the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model.
• •Perform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.
• •Investigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts.
• •Apply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.
• •Research Deep Web ecosystems, including crimeware-as-a-service and ransomware-as-a-service operations, to identify emerging threats, adversary relationships, and evolving attack methodologies.
• •Analyze Windows and macOS internals, including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.
• •Analyze and correlate large-scale datasets using Structured Query Language, Python, or Excel to identify patterns, generate actionable intelligence, and support evidence-based decisions.

Intelligence-to-Detection and Operational Impact

• •Translate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata.
• •Own the lifecycle of intelligence-driven detection improvements, from identifying intelligence gaps and developing detection hypotheses to validating coverage and measuring operational effectiveness.
• •Take accountability for ensuring that intelligence findings are translated into practical defensive improvements rather than remaining limited to research reports or theoretical assessments.
• •Develop intelligence-to-detection feedback loops that identify coverage gaps, assess detection effectiveness, and continuously improve defensive capabilities.
• •Partner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, investigation, and response workflows.
• •Provide escalation support for high-confidence threat events, including intelligence enrichment, attribution context, assessment of potential impact, and recommended response actions.
• •Contribute real-time intelligence support during active incidents and investigations, ensuring findings are communicated promptly and translated into actionable recommendations.
• •Support Request for Intelligence workflows by owning assigned requests from initial assessment through research, delivery, and follow-up, ensuring that outputs address the operational team's requirements.
• •Evaluate the effectiveness of intelligence-led initiatives using measurable outcomes such as detection coverage, investigation efficiency, escalation quality, and response time improvements.

Automation, Scalability, and Analytical Excellence

• •Develop automation and enrichment workflows using scripting languages such as Python to improve research efficiency, data quality, and intelligence delivery.
• •Identify opportunities to eliminate repetitive manual activities and build scalable intelligence workflows that support growing operational requirements.
• •Own the implementation and continuous improvement of assigned automation initiatives, ensuring they deliver measurable efficiency gains and remain reliable in production environments.
• •Establish repeatable research methodologies, intelligence validation practices, and analytical standards to improve consistency, accuracy, and reproducibility.
• •Analyze operational feedback, detection gaps, and intelligence quality metrics to identify improvement opportunities and prioritize initiatives based on their potential security impact.
• •Create scalable intelligence dissemination methods, including threat alerts, intelligence briefs, technical reports, and knowledge base updates, ensuring that relevant teams receive timely and actionable information.

Collaboration, Technical Leadership, and Knowledge Sharing

• •Collaborate with Detection Engineering, Threat Hunting, Incident Response, Security Operations Center, and Managed Detection and Response teams to align intelligence priorities with operational and customer security needs.
• •Take ownership of assigned intelligence initiatives and drive them forward independently, coordinating with relevant stakeholders to resolve dependencies and achieve agreed outcomes.
• •Provide technical guidance and mentorship to peers, share investigative techniques, and contribute to the development of technical standards within the research organization.
• •Communicate complex technical findings clearly to technical and operational audiences, ensuring that recommendations are understood, actionable, and aligned with business priorities.
• •Publish technical research, tradecraft methodologies, blogs, and whitepapers, or present findings at industry workshops and conferences.
• •Stay informed about emerging adversary tactics, techniques, and procedures, assess their relevance to Arctic Wolf customers, and proactively recommend improvements to intelligence coverage and defensive capabilities.

YOU WILL BE SUCCESSFUL IN THIS ROLE IF:

• •You have 5+ years of relevant experience and are recognized as a technical authority within one or more adversary ecosystems, such as ransomware, financially motivated crimeware, or nation-state operations.
• •You have strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.
• •You have hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.
• •You have experience with malware analysis tooling, host telemetry, and network telemetry analysis.
• •You possess strong knowledge of modern threat intelligence frameworks, analytical methodologies, and adversary research techniques.
• •You demonstrate end-to-end ownership by independ