Arctic Wolf—Threat Researcher

Job description

Description: At Arctic Wolf, you will not just watch the cybersecurity industry evolve – you will help lead the change. Our global team is made up of people who thrive on solving complex problems, moving quickly, and building technology that protects organizations around the world. We are proud to be recognized by Forbes, CNBC, Fortune, CRN, Gartner Peer Insights, and International Data Corporation MarketScape. What matters most is the work behind these recognitions: delivering real outcomes for customers through award-winning innovation such as our Aurora Platform. If you are looking for meaningful work, smart teammates, and the opportunity to make a real impact in a high-growth company that is redefining security operations, Arctic Wolf is the right place for you. Our mission is simple: End Cyber Risk. We are looking for a Threat Researcher to help achieve this mission. The Threat Researcher will contribute to our Detection Operations organization by developing, optimizing, and maintaining scalable detection capabilities that protect customers against evolving cyber threats. This role will focus on improving detection quality, expanding telemetry coverage, and building actionable detections across multiple security platforms and technologies. IN THIS ROLE, YOU WILL: • Develop and maintain Python and YAML-based detections, software, and supporting systems • Research and develop expertise across multiple threat surfaces and telemetry sources • Design and improve behavioral, anomaly-based, and signature-based detections • Continuously tune and optimize detections to improve quality, scale, and performance • Propose coverage and efficacy improvements across the detection surface • Collaborate with team members to develop novel detection methodologies and continuously improve existing detections • Build runbooks, reports, and supporting operational material for detection surfaces • Partner with cross-functional teams to gather requirements and implement detection capabilities • Write clean, efficient, reusable, and secure Python code • Conduct code reviews and provide constructive feedback to improve code quality and maintainability • Debug and resolve issues within existing Python codebases and detection systems • Participate in the full software development life cycle, building well-designed, testable, and efficient code • Optimize application and detection performance while ensuring scalability and reliability • Develop an understanding of the Arctic Wolf platform and Security Services delivery model • Apply company policies and procedures to resolve operational and technical issues • Continuously learn and adopt best practices in software engineering, detection development, and cybersecurity operations • Provide mentorship and technical guidance to team members where appropriate YOU WILL BE SUCCESSFUL IN THIS ROLE IF: • You have 4 or more years of professional experience as a Detection Developer or Security Developer • You have hands-on experience developing projects using Python or YAML • You have experience working with operating system telemetry including Windows Security logs, Sysmon, and Linux telemetry • You have experience with Windows PowerShell monitoring and detection development • You have experience building Security Information and Event Management detections • You have experience developing endpoint detection and response detections or signatures • You have experience working with Sigma and YARA rules • You have experience developing anomaly-based and behavioral detections • You have experience tuning and optimizing detections across multiple telemetry sources • You have strong problem-solving, debugging, and analytical skills • You are passionate about detection quality, scalability, and continuous improvement • You work effectively across distributed and cross-functional teams • You continuously adapt to emerging technologies, security trends, and development best practices Nice to have: • Professional certifications in security or cloud technologies such as Certified Information Systems Security Professional, GIAC Certified Forensic Analyst, GIAC Reverse Engineering Malware, or related certifications • Experience leading Agile development teams or formal Agile training • Familiarity with full-stack development frameworks and practices • Experience contributing to operational runbooks, reporting, or technical documentation CORE TECHNOLOGIES WE USE INCLUDE: • Python • Sigma • Suricata • Wazuh • Kibana • Git You are not required to be an expert in all of these technologies, but you should be excited about learning new tools and comfortable becoming productive quickly. WHAT SUCCESS LOOKS LIKE: • Development of scalable and actionable detections that improve customer protection • Continuous improvement of detection quality, coverage, and operational efficiency • Collaboration across teams to deliver reliable and effective detection capabilities • Consistent delivery of high-quality, maintainable, and scalable code • Active participation in innovation initiatives, technical demos, and collaborative development efforts We value a culture of sharing and innovation. Teams regularly present their work during monthly Research and Development demonstrations, and annually participate in a department-wide Hackathon focused on exploring new ideas and technologies outside normal project scope. Do not meet all the requirements? That is okay. We still encourage you to apply. We have many opportunities and are always looking for strong talent. On-Camera Policy To support a fair, transparent, and engaging interview experience, candidates interviewing remotely are expected to be on camera during all video interviews. Being on camera fosters authentic connection, improves communication, and allows for full engagement from both candidates and interviewers. We understand that technical, bandwidth, or location-related challenges may occasionally prevent video use. If this applies, candidates are required to notify us in advance so we can explore appropriate accommodations. At Arctic Wolf, we foster a collaborative and inclusive work environment that thrives on diversity of thought, background, and culture. This is reflected in our multiple awards, including Top Workplace United States, Best Places to Work United States, Great Place to Work Canada, Great Place to Work United Kingdom, and Kununu Top Company Germany. Our commitment to bold growth and shaping the future of security operations is matched by our dedication to customer satisfaction, with over 10,000 customers worldwide and more than 2,000 channel partners globally. As we continue to expand and enhance our technology, Arctic Wolf remains a trusted name in the industry. Our Values Arctic Wolf recognizes that success comes from delighting our customers, so we work together to ensure that happens every day. We believe in diversity and inclusion and value the unique perspectives all employees bring to the organization. By protecting sensitive data and working to end cyber risk, we contribute to an industry that serves the greater good. We celebrate diverse perspectives through our Pack Unity program and encourage employees to participate in or create new alliances. We also believe in corporate responsibility and have joined the Pledge One Percent movement to give back to our communities. All employees receive compelling compensation and benefits packages, including: • Equity for all employees • Flexible annual leave, paid holidays, and volunteer days • Training and career development programs • Comprehensive private benefits plan including medical insurance for you and your family, life insurance equal to three times compensation, and personal accident insurance • Fertility support and paid parental leave Arctic Wolf is an equal opportunity employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics, or any other basis forbidden under applicable law. We are committed to fostering a welcoming, accessible, and inclusive environment. Security Requirements • Conduct duties in accordance with Arctic Wolf information security policies, standards, and controls • Background checks are required for this position • This role may require access to information protected under United States export control laws and regulations