Staff Threat Intelligence Researcher

Arctic Wolf

. Independently lead complex adversary investigations and help shape how the organization identifies, validates, tracks, and responds to emerging threats across a large, multi-customer telemetry environment .

Posted 11/11/2026full-timeRemote • United States, CanadaLead💰 $86,000 - $240,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cyber threat intelligence, adversary research, and threat hunting, with strong technical leadership in analyzing large datasets and developing detection strategies. Proficient in translating intelligence into actionable insights and communicating findings effectively to diverse audiences.

Highest-signal resume keywords

Cyber Threat IntelligenceThreat HuntingMalware AnalysisIncident ResponseYARA Development

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SQLPythonKusto Query LanguageSPLMalware AnalysisIncident ResponseData AnalysisThreat DetectionCampaign ClusteringAnalytical Confidence

Soft Skills

Technical LeadershipCommunicationJudgmentMentoring

Tools & Technologies

SIEMEDRGhidraIDA ProX64dbgZeekSysmonAuditd

Industry Keywords

Nation-StateCybercriminalRansomwareVulnerability ExploitationMITRE ATT&CKDiamond ModelBehavioral AnalyticsIntelligence Validation

Tech Stack

Tools & technologies

CloudDNSPythonSQL

About the role

Key responsibilities & impact

Independently lead complex adversary investigations and help shape how the organization identifies, validates, tracks, and responds to emerging threats across a large, multi-customer telemetry environment
Lead rapid-response research into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity
Proactively hunt across internal MDR and IR telemetry to identify active campaigns, previously unknown infrastructure, malware, intrusion patterns, and common adversary behaviors
Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source data to develop and test campaign hypotheses
Determine affected customers, observed behaviors, intrusion timelines, infrastructure overlap, and confidence in campaign or actor clustering
Produce time-sensitive intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings
Develop and operationalize YARA, Sigma, behavioral analytics, search logic, indicators, and detection hypotheses with detection engineering, threat hunting, and security operations teams
Partner with Adversary Response and Incident Response teams during active investigations
Establish and apply standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation
Build repeatable research methods, tooling, and automation to reduce time from initial signal to validated finding and customer protection
Publish internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums
Mentor other researchers and develop repeatable campaign-investigation tradecraft

Requirements

What you’ll need

Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a related discipline, with demonstrated technical leadership as a senior individual contributor
Deep knowledge of nation-state, cybercriminal, ransomware, initial-access, malware, and vulnerability-exploitation ecosystems
Demonstrated experience hunting across large-scale endpoint, network, cloud, identity, email, and security-operations telemetry using SIEM, EDR, data-lake, or similar analysis platforms
Strong ability to use SQL, Python, Kusto Query Language, SPL, or comparable languages to analyze large datasets, automate enrichment, and build reusable research workflows
Experience analyzing host and network telemetry such as process execution, command lines, authentication events, DNS, proxy, firewall, Zeek, Sysmon, auditd, and cloud audit logs
Experience translating intelligence into YARA, Sigma, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements
Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence
Familiarity with malware-analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities
Proven ability to author publication-quality threat research and communicate technical findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences
Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or fast-moving security incidents
Candidates interviewing remotely are expected to be on camera during all video interviews
Employment may be subject to background verification and additional regulatory, security, or compliance requirements, including data protection, export control, and authorization requirements where applicable

Benefits

Comp & perks

Equity for all employees
Flexible time off and paid volunteer days
401(k) contribution and matching
Training and career development programs
Comprehensive private benefits plan including medical, mental health, dental, disability, life and AD&D, and value-added services
Robust Employee Assistance Program (EAP) with mental health services
Fertility support and paid parental leave
Variable incentive compensation
New hire equity grants