Senior Threat Intelligence Researcher

Overview

Senior Threat Intelligence Researcher on Arctic Wolf's Threat Intelligence team, leading advanced cyber threat intelligence research and turning adversary insights into measurable defensive outcomes as a senior technical authority.

What you'll do

• Lead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.
• Own end-to-end cyber threat intelligence investigations, from initial research and hypothesis development through validation, reporting, and operational implementation.
• Conduct cyber threat intelligence research aligned with the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model.
• Perform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.
• Investigate malicious network infrastructure and command-and-control activity by pivoting across domains, Internet Protocol addresses, certificates, and related artifacts.
• Apply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.
• Research Deep Web ecosystems, including crimeware-as-a-service and ransomware-as-a-service operations, to identify emerging threats, adversary relationships, and evolving attack methodologies.
• Analyze Windows and macOS internals, including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.
• Analyze and correlate large-scale datasets using Structured Query Language, Python, or Excel to identify patterns, generate actionable intelligence, and support evidence-based decisions.
• Translate intelligence findings into actionable detection and threat hunting logic using technologies such as YARA, Sigma, and Suricata.
• Own the lifecycle of intelligence-driven detection improvements, from identifying intelligence gaps and developing detection hypotheses to validating coverage and measuring operational effectiveness.
• Take accountability for ensuring intelligence findings are translated into practical defensive improvements rather than remaining limited to research reports or theoretical assessments.
• Develop intelligence-to-detection feedback loops that identify coverage gaps, assess detection effectiveness, and continuously improve defensive capabilities.
• Partner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, investigation, and response workflows.
• Provide escalation support for high-confidence threat events, including intelligence enrichment, attribution context, assessment of potential impact, and recommended response actions.
• Contribute real-time intelligence support during active incidents and investigations, communicating findings promptly and translating them into actionable recommendations.
• Support Request for Intelligence workflows by owning assigned requests from initial assessment through research, delivery, and follow-up.
• Evaluate the effectiveness of intelligence-led initiatives using measurable outcomes such as detection coverage, investigation efficiency, escalation quality, and response time improvements.
• Develop automation and enrichment workflows using scripting languages such as Python to improve research efficiency, data quality, and intelligence delivery.
• Identify opportunities to eliminate repetitive manual activities and build scalable intelligence workflows that support growing operational requirements.
• Own the implementation and continuous improvement of assigned automation initiatives, ensuring measurable efficiency gains and reliability in production environments.
• Establish repeatable research methodologies, intelligence validation practices, and analytical standards to improve consistency, accuracy, and reproducibility.
• Analyze operational feedback, detection gaps, and intelligence quality metrics to identify improvement opportunities and prioritize initiatives by potential security impact.
• Create scalable intelligence dissemination methods, including threat alerts, intelligence briefs, technical reports, and knowledge base updates.
• Collaborate with Detection Engineering, Threat Hunting, Incident Response, Security Operations Center, and Managed Detection and Response teams to align intelligence priorities with operational and customer security needs.
• Take ownership of assigned intelligence initiatives and drive them forward independently, coordinating with stakeholders to resolve dependencies and achieve agreed outcomes.
• Provide technical guidance and mentorship to peers, share investigative techniques, and contribute to technical standards within the research organization.
• Communicate complex technical findings clearly to technical and operational audiences, ensuring recommendations are understood, actionable, and aligned with business priorities.
• Publish technical research, tradecraft methodologies, blogs, and whitepapers, or present findings at industry workshops and conferences.
• Stay informed about emerging adversary tactics, techniques, and procedures, assess their relevance to Arctic Wolf customers, and proactively recommend improvements to intelligence coverage and defensive capabilities.

What you'll need

• 5+ years of relevant experience and recognized as a technical authority within one or more adversary ecosystems, such as ransomware, financially motivated crimeware, or nation-state operations.
• Strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.
• Hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.
• Experience with malware analysis tooling, host telemetry, and network telemetry analysis.
• Strong knowledge of modern threat intelligence frameworks, analytical methodologies, and adversary research techniques.
• Demonstrated end-to-end ownership by independently driving investigations and intelligence initiatives from problem identification through execution, validation, and measurable outcomes.
• Ability to translate complex intelligence findings into actionable recommendations and demonstrate how your work improves detection coverage, investigation quality, or defensive capabilities.
• Accountability for the quality, accuracy, timeliness, and operational relevance of intelligence deliverables.
• Proactive identification of gaps in intelligence coverage, investigative processes, and detection capabilities, driving improvements without waiting for predefined instructions.
• Comfort working independently in ambiguous, fast-changing threat environments, making informed decisions and adapting as new evidence emerges.
• Strong analytical, communication, and problem-solving skills, with the ability to explain technical findings and their operational implications.
• Experience mentoring peers, sharing technical expertise, and contributing to research standards and best practices.

Nice to have

• Experience publishing threat research, whitepapers, or presenting at industry conferences.
• Experience collaborating with external intelligence-sharing communities or trusted industry partners.
• Experience building scalable threat intelligence workflows, enrichment pipelines, and operational frameworks.
• Familiarity with large-scale telemetry analysis and data science methodologies.
• Experience automating intelligence research, enrichment, and analysis workflows.
• Experience defining success metrics, measuring the effectiveness of intelligence-led initiatives, and using operational feedback to drive continuous improvement.
• Experience leading cross-functional initiatives and delivering outcomes in environments where requirements and priorities evolve rapidly.

Details

• Location: Bengaluru, India (Helios Business Park).
• Employment may be subject to background verification and additional regulatory, security, or compliance requirements, including authorization requirements where applicable.