- Company Name
- Arctic Wolf
- Job Title
- Lead Threat Researcher
- Job Description
-
**Job Title:** Lead Threat Researcher
**Role Summary:**
Lead a multidisciplinary security research and development team to design, build, and maintain high‑value detection capabilities across endpoint, network, and cloud environments. Drive technical direction, produce actionable threat intelligence, develop and tune detections, and mentor team members while ensuring secure software practices and alignment with product strategy.
**Expectations:**
- Deliver robust, tested security solutions that reduce managed risk.
- Provide continuous improvement on detection coverage and tuning, prioritizing new and emerging threats.
- Collaborate with product, operations, and services teams to shape long‑term security outcomes.
- Mentor and grow technical talent within the team.
**Key Responsibilities:**
- Conduct in‑depth research on threat surfaces, telemetry, and emerging threats.
- Propose and implement coverage and efficacy improvements to detection surfaces.
- Develop novel detections (SIEM, NDR/IPS/IDS, EDR, Sigma/Yara, cloud).
- Participate fully in the software development lifecycle: design, coding (Python, Go, Java, C/C++), testing, deployment, and maintenance.
- Build runbooks, reports, and documentation, and share findings with technical and non‑technical stakeholders.
- Troubleshoot, educate, and disseminate security knowledge across the organization.
- Lead technical projects, ensuring adherence to secure development practices, TDD, and DevOps pipelines.
- Mentor junior researchers and developers, fostering knowledge transfer and professional growth.
**Required Skills:**
- Deep expertise in security tooling: SIEM, NDR/IPS/IDS, EDR, Sigma/Yara, cloud security, anomaly/behavioural detection development.
- Proven development experience (Python required; Go, Java, C/C++ valuable).
- Secure software engineering: TDD, secure coding, DevOps pipelines, container/Kubernetes, cloud (AWS, Azure, GCP).
- Strong analytical skills: vulnerability scanner knowledge (Qualys, Rapid7, Tenable), telemetry analysis, threat intelligence.
- Familiarity with NGFWs (PAN, CISCO, Fortinet), open‑source IPS/IDS/NSM (Bro/Zeek, Suricata), SIEM analytics platforms (Splunk, Elastic).
- Agile frameworks (SCRUM, Kanban) experience.
- Excellent communication: explain complex security concepts to non‑technical audiences.
- Leadership and mentorship demonstrated in prior roles.
**Required Education & Certifications:**
- Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Information Systems, or related field.
- Relevant certifications preferred: CISSP, GCIH, GCIA, CCSP, or equivalent.