Cyber Threat Intelligence Researcher

Artemis

. Investigate emerging campaigns, attacker infrastructure, exploitation techniques, and changes in adversary tradecraft across cloud, identity, endpoint, SaaS, AI, and data environments .

Posted 10/30/2026full-timeNew York City • New York • United StatesMid-LevelSenior💰 $160,000 - $200,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat intelligence and research, with strong capabilities in Python, API utilization, and telemetry analysis to drive actionable insights and operational outcomes. Proficient in communicating complex technical findings to diverse audiences while maintaining a focus on customer risk and confidentiality.

Highest-signal resume keywords

Threat IntelligencePython ProgrammingTelemetry AnalysisTechnical WritingMITRE ATT&CK Familiarity

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat ResearchThreat HuntingIncident InvestigationSQLKQLSPLMalware AnalysisInfrastructure TrackingData AnalysisHypothesis-Driven Hunts

Soft Skills

Analytical DisciplineJudgmentCommunicationPrioritizationCustomer Engagement

Tools & Technologies

AI-Assisted WorkflowsDetection PlatformsSTIX/TAXIIDetection-as-Code WorkflowsTelemetry Tools

Industry Keywords

CybersecurityAdversary EmulationCloud AttacksSaaS CompromiseCybercrime CampaignsThreat BriefingsMDRMSSP

Tech Stack

Tools & technologies

CloudCyber SecurityDNSPythonSQL

About the role

Key responsibilities & impact

Investigate emerging campaigns, attacker infrastructure, exploitation techniques, and changes in adversary tradecraft across cloud, identity, endpoint, SaaS, AI, and data environments
Combine external reporting with authorized telemetry analysis to develop evidence-grounded findings
Own the research roadmap and intelligence priorities for Artemis’s managed offering
Define customer-relevant threats and questions, evaluate intelligence sources and partners, and establish intelligence collection, assessment, delivery, and maintenance processes
Write original technical blogs, campaign analyses, threat advisories, and research reports
Explain attack behavior, supporting evidence, defensive implications, and practical hunting guidance to technical and executive audiences
Translate novel threats and research hypotheses into hunts across customer environments
Identify relevant telemetry, develop queries and behavioral correlations, investigate results, and create reusable hunt templates
Track actors and campaigns by connecting infrastructure, tooling, victimology, and observed behaviors
Maintain campaign and activity-cluster assessments, distinguishing facts, judgments, confidence levels, and attribution uncertainty
Partner with detection engineers and the SOC to turn research into detections, investigation guidance, enrichment, and response recommendations
Manage the quality and lifecycle of indicators and intelligence content, including provenance, relevance, confidence, and expiration
Investigate attacker use of AI and threats targeting AI applications, agents, tools, and connected data
Use Python, APIs, and AI-assisted workflows to accelerate collection, enrichment, correlation, and analysis
Verify sources and conclusions independently, preserve evidence, and build repeatable research workflows
Brief customers and internal teams on relevant developments, exposure, observed activity, and concrete next steps
Measure impact through useful hunts, coverage improvements, and customer decisions, and refine the intelligence program using feedback

Requirements

What you’ll need

5+ years of hands-on cybersecurity experience, with substantial work in threat intelligence, threat research, threat hunting, or incident investigation; equivalent demonstrated expertise is welcome
Track record of producing original, evidence-backed research and clear technical writing
Strong understanding of attacker tactics, techniques, and procedures, with depth in at least one relevant area such as cloud and identity attacks, SaaS compromise, cybercrime campaigns, or targeted intrusions
Experience developing and executing hypothesis-driven hunts, analyzing security telemetry, and correlating activity across sources using SQL, KQL, SPL, or similar query languages
Experience turning intelligence into operational outcomes, including detections, hunt content, incident insights, or customer guidance
Practical Python and API skills for research automation, enrichment, and data analysis
Sound judgment when using AI to support research
Strong analytical discipline, including evaluating source reliability, testing alternative explanations, communicating confidence, and avoiding overstated attribution or coverage
Ability to prioritize research around customer risk, own work through delivery, and explain technical findings clearly to practitioners and leadership
Good judgment handling sensitive telemetry, source restrictions, and publication review, including protecting customer identities and confidential information
Experience with malware analysis, infrastructure tracking, passive DNS, sandboxing, or adversary emulation
Familiarity with MITRE ATT&CK and ATLAS, STIX/TAXII, intelligence platforms, or detection-as-code workflows
Customer-facing experience delivering threat briefings, research findings, or hunting outcomes in an MDR, MSSP, or security product environment
Work authorization is requested on the application form

Benefits

Comp & perks

Top-of-market equity component
Opportunity to make real-world impact through research, hunts, detections, and intelligence
Opportunity to publish original research and shape Artemis’s research voice
Opportunity to own and build the managed threat intelligence strategy
Collaboration with detection engineers, offensive researchers, analysts, and AI engineers
Inclusive work environment