Threat Intelligence Researcher

Overview

Lead advanced cyber threat intelligence research, translating adversary insights into measurable defensive outcomes. This senior technical role shapes intelligence methodologies, sets analytical standards, mentors peers, and delivers actionable intelligence that strengthens Arctic Wolf's security operations and customer protection.

What you'll do

• Lead and contribute to threat actor, malware family, and campaign tracking by correlating malware samples, infrastructure, delivery mechanisms, and adversary tradecraft.
• Conduct end-to-end cyber threat intelligence research aligned with the Cyber Threat Intelligence lifecycle, MITRE ATT&CK, and the Diamond Model.
• Perform static and dynamic malware analysis across malicious binaries, scripts, and document-based delivery mechanisms.
• Investigate malicious network infrastructure and command-and-control activity by pivoting across domains, IP addresses, certificates, and related artifacts.
• Translate intelligence findings into actionable detection and threat hunting logic using YARA, Sigma, and Suricata.
• Analyze Windows or macOS internals including application programming interfaces, obfuscation techniques, system calls, and execution behaviors.
• Apply advanced open-source intelligence techniques, pivoting methodologies, and enrichment across multiple intelligence platforms and data sources.
• Research Deep Web ecosystems including crimeware-as-a-service and ransomware-as-a-service operations.
• Analyze and correlate large-scale datasets using SQL, Python, or Excel to extract actionable intelligence insights.
• Develop automation and enrichment workflows using scripting languages such as Python.
• Partner closely with Security Operations Center and Managed Detection and Response teams to operationalize intelligence into detection, triage, and response workflows.
• Support Request for Intelligence workflows by delivering timely and actionable intelligence to operational teams.
• Provide escalation support for high-confidence threat events, including enrichment, attribution context, and recommended response actions.
• Contribute real-time intelligence support during active incidents and investigations.
• Develop intelligence-to-detection feedback loops that improve coverage and operational visibility.
• Create scalable intelligence dissemination methods including alerts, intelligence briefs, and knowledge base updates.
• Standardize analytical frameworks, intelligence validation practices, and operational research methodologies.
• Publish technical research, tradecraft methodologies, blogs, whitepapers, or present at industry workshops and conferences.

What you'll need

• 3+ years of relevant experience.
• Recognized as a technical authority within one or more adversary ecosystems such as ransomware, financially motivated crimeware, or nation-state operations.
• Strong experience in cyber threat intelligence research, adversary tracking, and intelligence analysis.
• Hands-on experience applying threat intelligence to detection engineering, threat hunting, incident response, or threat modeling.
• Experience with malware analysis tooling, host telemetry, and network telemetry analysis.
• Strong knowledge of modern threat intelligence frameworks and methodologies.
• Experience translating intelligence into measurable operational outcomes and defensive improvements.
• Comfortable working independently within highly ambiguous and rapidly evolving threat environments.
• Strong analytical, communication, and problem-solving skills.
• Experience mentoring peers and shaping technical standards within research organizations.
• Passion for improving intelligence-driven security operations and defensive capabilities.

Nice to have

• Experience publishing threat research, whitepapers, or presenting at industry conferences.
• Experience collaborating with external intelligence-sharing communities or trusted industry partners.
• Experience building scalable threat intelligence workflows and operational frameworks.
• Familiarity with large-scale telemetry analysis and data science methodologies.
• Experience automating intelligence workflows and enrichment pipelines.

Details

• Location: Bengaluru, India.
• Candidates interviewing remotely are expected to be on camera during all video interviews.
• Background checks are required for this position.
• This role may require access to information protected under United States export control laws and regulations.