Senior Threat Researcher (Integrations Team)

Third-Party Integration Detection Development

• Act as a technical leader and mentor to detection engineers across the XDR program and third-party integrations.
• Serve as a detection subject matter expert within the Integrations Team.
• Apply broad expertise and knowledge across multiple telemetry domains, including endpoint, network, cloud, identity, and email, to design detections that generalize across diverse customer environments.
• Contribute to the development of detection strategies and principles to achieve coverage goals in creative and effective ways.
• Produce detection specifications and coverage models and determine operational feasibility.
• Develop detections, correlation rules, and analytics based on telemetry ingested from third-party integrations.
• Analyse vendor APIs, audit logs, alerts, and event schemas to identify security detection opportunities.
• Design detection coverage that leverages data from integrated security products, cloud providers, identity platforms, email security solutions, and endpoint security tools.
• Partner closely with integration engineers to understand newly onboarded data sources and maximize security value from collected telemetry.
• Provide technical guidance and direction to developers through the design, implementation, testing, and tuning of detection content at scale.

Detection Research

• Research emerging threats, attack techniques, and adversary tactics.
• Work on significant and unique detection challenges where analysis of attacker behaviour requires evaluation of complex, cross-domain signal correlation.
• Apply conceptual thinking to understand advanced threats, novel attack chains, and their implications across telemetry boundaries.
• Identify opportunities to detect malicious activity using third-party security and SaaS telemetry.
• Map detections to the MITRE ATT&CK framework and maintain alignment with evolving threat landscapes.
• Continuously improve existing detections by reducing false positives and increasing attack coverage.
• Exercise independent judgment in detection methodology, technique selection, and evaluation criteria for measuring detection efficacy.
• Provide thought leadership on cross-telemetry detection approaches and contribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.

Security Domain Coverage: Develop detections across multiple security domains, including:

Identity & Access Security

• Account takeover
• MFA abuse and bypass
• Privilege escalation
• Suspicious administrative activity
• Service account misuse
• OAuth and application abuse

Email Security

• Business Email Compromise (BEC)
• Phishing campaigns
• Malicious attachment activity
• Email forwarding rule creation
• Suspicious mailbox access
• Abnormal email behaviours

Endpoint Security

• Malware and ransomware activity
• Credential theft techniques
• Suspicious process execution
• Persistence mechanisms
• Lateral movement
• Defence evasion
• Living-off-the-land techniques
• Endpoint compromise indicators

Cloud Security

• Excessive permission changes
• Suspicious cloud administration activity
• Data exfiltration attempts
• Resource misconfigurations
• Cloud account abuse
• Workload compromise activity

Network Security

• Analyse network telemetry and cross-domain signals to identify attacker behaviour.
• Develop detection approaches using network telemetry such as NetFlow, Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), Transport Layer Security (TLS) metadata, and Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) telemetry.
• Correlate network activity with endpoint, cloud, identity, and email telemetry where applicable.

Detection Validation & Quality

• Validate detections against attack simulations, threat scenarios, and real-world telemetry.
• Assess data quality and telemetry completeness across integrations.
• Continuously monitor detection performance and effectiveness.
• Identify gaps in attack coverage and recommend enhancements.
• Define and apply evaluation criteria for measuring detection efficacy.
• Test and tune detection content to ensure high-value and performant detections at scale.

Cross-Functional Collaboration

• Collaborate with Integration Engineers, Product Managers, Detection Engineers, Threat Researchers, and Security Operations Center (SOC) teams.
• Work closely with Pipeline, Platform, Threat Enablement, and Artificial Intelligence teams.
• Provide requirements and feedback for new integrations to ensure detection-readiness.
• Help shape onboarding strategies for new vendors by identifying telemetry needed for meaningful security analytics.
• Influence normalization and data-modelling efforts to support scalable detection development.
• Convey advanced detection concepts and technical information to diverse stakeholders and audiences.
• Contribute to broader organizational projects requiring an understanding of the wider XDR ecosystem.

• 6+ years of experience in Detection Engineering, Threat Hunting, Security Research, SOC Engineering, or Security Analytics.
• Expert-level Python expertise, with the ability to build detection tooling, automation, and frameworks.
• Deep understanding of diverse telemetry sources and their strengths and limitations, including: Endpoint: Windows Security and Sysmon logs, Linux auditd, macOS Unified Logs, and Endpoint Detection and Response (EDR) telemetry. Network: NetFlow, DNS, HTTP/TLS metadata, and IDS/IPS such as Suricata. Cloud: Amazon Web Services (AWS) CloudTrail, Azure Activity Logs, Google Cloud Platform (GCP) Audit Logs, and Kubernetes audit logs. Identity: Identity Provider (IdP) logs such as Okta and Azure Active Directory/Entra ID, authentication, and authorization events. Email: Mail flow logs, phishing indicators, and header analysis.
• Experience building detections using telemetry from cloud, endpoint, identity, email, or security platforms.
• Ability to analyse new third-party integrations, understand vendor-specific schemas and APIs, and rapidly develop detection coverage from ingested telemetry.
• Hands-on experience with one or more detection technologies such as Kusto Query Language (KQL), Splunk Processing Language (SPL), Sigma, Structured Query Language (SQL), or equivalent analytics languages.
• Strong understanding of security telemetry, event correlation, and detection tuning.
• Experience working with data from security products, cloud platforms, identity providers, or SaaS applications.
• Familiarity with endpoint, identity, cloud, network, and email security telemetry.
• Ability to analyse unfamiliar security event schemas and rapidly build detections from new data sources.
• Good understanding of adversary tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK framework.
• Experience designing detection strategies, coverage models, and detection specifications.
• Ability to evaluate detection effectiveness and identify opportunities to improve attack coverage.
• Experience providing technical guidance, mentoring, or direction to other detection engineers or developers.

• Experience with Security Information and Event Management (SIEM), Extended Detection and Response (XDR), Managed Detection and Response (MDR), Cloud Native Application Protection Platform (CNAPP), or Identity Threat Detection platforms.
• Familiarity with security data normalization frameworks such as Open Cybersecurity Schema Framework (OCSF).
• Experience working across multiple telemetry domains and developing cross-domain or generalized detection approaches.
• Experience with attack simulation and detection validation.
• Experience working with third-party security integrations and vendor-specific data models.
• Experience with XDR detection programs or large-scale detection content development.

Arctic Wolf recognizes that success comes from delighting our customers, so we work together to ensure that happens every day. We believe in diversity and inclusion and value the unique perspectives all employees bring to the organization. By protecting sensitive data and working to end cyber risk, we contribute to an industry that serves the greater good. We celebrate diverse perspectives through our Pack Unity program and encourage employees to participate in or create new alliances. We also believe in corporate responsibility and have joined the Pledge One Percent movement to give back to our communities. All Employees Receive Compelling Compensation And Benefits Packages, Including

• Equity for all employees
• Flexible annual leave, paid holidays, and volunteer days
• Training and career development programs
• Comprehensive private benefits plan including medical insurance for you and your family, life insurance equal to three times compensation, and personal accident insurance
• Fertility support and paid parental leave

Arctic Wolf is an equal opportunity employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under applicable law. We are committed to fostering a welcoming, accessible, and inclusive environment.

• Conduct duties in accordance with Arctic Wolf information security policies, standards, and controls.
• Background checks are required for this position.
• This role may require access to information protected under United States export control laws and regulations, including the Export Administration Regulations. If applicable, an offer of employment will be conditioned upon authorization to receive software or technology controlled under these regulations.