Want to know if this job is worth applying to?
Bengaluru, Karnataka, India
Onsite
At Arctic Wolf, we’re on a mission to end cyber risk.
We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity.
More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.
We’re constantly looking for talented people to join the Pack and help us take our performance to the next level.
We are looking for a Staff Threat Researcher Endpoint/Cloud - Detections to help achieve this mission.
The Staff Threat Researcher Endpoint/Cloud - Detections will contribute to our Detection Engineering organization by developing, maintaining, and enhancing advanced security detections across endpoint, cloud, and network environments. This role will focus on building high-quality detection content, improving detection efficacy, researching emerging threats, and delivering actionable intelligence that helps protect Arctic Wolf customers from evolving cyber threats.
IN THIS ROLE, YOU WILL:
• Develop and maintain high-quality custom detection rules across endpoint, cloud, and network environments
• Research emerging threats, attack techniques, and telemetry sources to improve detection coverage and effectiveness
• Design, develop, and continuously improve anomaly-based and behavioral-based detections
• Conduct code reviews and provide constructive feedback to ensure code quality, maintainability, and scalability
• Troubleshoot, debug, and enhance existing detection and signature codebases
• Participate in the full software development life cycle by building secure, efficient, testable, and maintainable detection content
• Collaborate with team members to develop innovative detections and continuously tune existing detection capabilities
• Propose improvements to detection coverage, efficacy, and overall security visibility
• Build runbooks, reports, documentation, and supporting materials for detection surfaces
• Document research findings and share knowledge across engineering, security operations, and research teams
• Communicate technical concepts and security findings effectively to both technical and non-technical audiences
• Continuously learn and adopt industry best practices in software development, detection engineering, and cybersecurity
• Participate in research and development demonstrations, innovation initiatives, and annual hackathon events that contribute to future product capabilities
YOU WILL BE SUCCESSFUL IN THIS ROLE IF:
• You have 11 or more years of experience authoring and maintaining security detections
• You have strong expertise in endpoint, cloud, or network detection and signature development
• You have experience developing anomaly-based and behavioral-based detections
• You have extensive experience tuning and optimizing detections to improve fidelity and reduce false positives
• You have experience using MITRE ATT&CK, packet capture analysis, and threat intelligence sources to drive detection development
• You have strong knowledge of cybersecurity principles, threat detection methodologies, and adversary behaviors
• You have experience working with security monitoring and detection technologies within Managed Detection and Response environments
• You are passionate about solving complex security challenges and continuously improving detection capabilities
Helpful to Have:
• Experience developing Security Information and Event Management detections
• Experience creating Endpoint Detection and Response detections and signatures
• You possess knowledge of networking concepts, protocols, and authentication technologies including Transmission Control Protocol/Internet Protocol, Domain Name System, Lightweight Directory Access Protocol, and New Technology LAN Manager
• You have proven experience researching and developing detections related to network-based threat vectors
• Experience authoring Sigma and YARA rules
• Experience developing cloud security detections
• Experience with programming languages such as Python, Go, Java, or C++
• Experience with Test Driven Development methodologies
• Experience using DevOps practices, tooling, and automation frameworks
• Experience applying secure software development practices
• Experience building and deploying solutions in cloud environments including Amazon Web Services, Microsoft Azure, and Google Cloud Platform
• Experience working with Kubernetes, containers, infrastructure-as-a-service, and platform-as-a-service technologies
• Experience working within Agile software development methodologies including Scrum and Kanban
• Experience with Next Generation Firewall technologies from vendors such as Palo Alto Networks, Cisco, or Fortinet
• Experience using open-source intrusion detection, intrusion prevention, and network security monitoring technologies such as Zeek or Suricata
Do not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent.
All wolves receive compelling compensation and benefits packages, including:
At Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security policies, standards, and controls designed to safeguard the confidentiality, integrity, and availability of business, customer, employee, and other confidential information and to support compliance with applicable legal and regulatory requirements.
Depending on the role and where permitted by applicable law, employment may be subject to background verification and additional regulatory, security, or compliance requirements, including obligations related to data protection and export control laws, and authorization requirements where applicable.