Senior Threat Researcher - Endpoint/Cloud

Overview

Senior Threat Researcher focused on endpoint, cloud, and network detections within Arctic Wolf's Detection Engineering organization, building high-quality detection content and delivering actionable threat intelligence to protect customers.

What you'll do

• Develop and maintain high-quality custom detection rules across endpoint, cloud, and network environments
• Research emerging threats, attack techniques, and telemetry sources to improve detection coverage and effectiveness
• Design, develop, and continuously improve anomaly-based and behavioral-based detections
• Conduct code reviews and provide constructive feedback to ensure code quality, maintainability, and scalability
• Troubleshoot, debug, and enhance existing detection and signature codebases
• Participate in the full software development life cycle by building secure, efficient, testable, and maintainable detection content
• Collaborate with team members to develop innovative detections and continuously tune existing detection capabilities
• Propose improvements to detection coverage, efficacy, and overall security visibility
• Build runbooks, reports, documentation, and supporting materials for detection surfaces
• Document research findings and share knowledge across engineering, security operations, and research teams
• Communicate technical concepts and security findings effectively to both technical and non-technical audiences
• Continuously learn and adopt industry best practices in software development, detection engineering, and cybersecurity
• Participate in research and development demonstrations, innovation initiatives, and annual hackathon events that contribute to future product capabilities

What you'll need

• 5 or more years of experience authoring and maintaining security detections
• Strong expertise in endpoint, cloud, or network detection and signature development
• Experience developing anomaly-based and behavioral-based detections
• Extensive experience tuning and optimizing detections to improve fidelity and reduce false positives
• Experience using MITRE ATT&CK, packet capture analysis, and threat intelligence sources to drive detection development
• Strong knowledge of cybersecurity principles, threat detection methodologies, and adversary behaviors
• Experience working with security monitoring and detection technologies within Managed Detection and Response environments
• Passion for solving complex security challenges and continuously improving detection capabilities

Nice to have

• Experience developing Security Information and Event Management detections
• Experience creating Endpoint Detection and Response detections and signatures
• Knowledge of networking concepts, protocols, and authentication technologies including Transmission Control Protocol/Internet Protocol, Domain Name System, Lightweight Directory Access Protocol, and New Technology LAN Manager
• Proven experience researching and developing detections related to network-based threat vectors
• Experience authoring Sigma and YARA rules
• Experience developing cloud security detections
• Experience with programming languages such as Python, Go, Java, or C++
• Experience with Test Driven Development methodologies
• Experience using DevOps practices, tooling, and automation frameworks
• Experience applying secure software development practices
• Experience building and deploying solutions in cloud environments including Amazon Web Services, Microsoft Azure, and Google Cloud Platform
• Experience working with Kubernetes, containers, infrastructure-as-a-service, and platform-as-a-service technologies
• Experience working within Agile software development methodologies including Scrum and Kanban
• Experience with Next Generation Firewall technologies from vendors such as Palo Alto Networks, Cisco, or Fortinet
• Experience using open-source intrusion detection, intrusion prevention, and network security monitoring technologies such as Zeek or Suricata

Details

• Location: Bengaluru, India (modern workplace in Helios Business Park)
• Background verification and additional regulatory, security, or compliance requirements may apply depending on the role and where permitted by law