Staff Threat Intelligence Researcher

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Staff Threat Intelligence Researcher based in the Canada .

The Staff Threat Intelligence Researcher is a senior individual contributor responsible for leading complex investigations into emerging cyber threats, active campaigns, and high-impact adversary activity. Working closely with adversary operations, threat hunting, and incident response teams, this role analyzes large-scale security telemetry across multiple customer environments to identify and understand sophisticated threats. You will connect endpoint, network, cloud, identity, malware, and open-source intelligence to develop evidence-based assessments of campaigns and threat actors. Your findings will directly inform detection strategies, incident response, customer protections, and security operations. The role combines hands-on technical research with the development of repeatable investigation methods, automation, and intelligence standards. You will also contribute original research, mentor other researchers, and help strengthen the broader cybersecurity community's understanding of evolving threats.

Accountabilities

Lead rapid-response investigations into emerging threats, newly disclosed vulnerabilities, active exploitation, malware campaigns, ransomware operations, and nation-state or cybercriminal activity.

• Proactively hunt across internal managed detection and response (MDR) and incident response (IR) telemetry to uncover active campaigns, unknown infrastructure, malware, intrusion patterns, and recurring adversary behaviors.

• Correlate endpoint, network, cloud, identity, email, vulnerability, malware, infrastructure, case, and open-source intelligence to develop and validate investigation hypotheses.

• Determine the scope and potential impact of widespread activity, including affected customers, observed behaviors, intrusion timelines, infrastructure connections, and confidence in campaign or actor assessments.

• Produce timely intelligence assessments, threat advisories, hunting packages, campaign reports, and executive or customer briefings during significant security events.

• Develop and operationalize YARA and Sigma rules, behavioral analytics, search logic, indicators, and detection hypotheses in collaboration with detection engineering and security operations teams.

• Support active investigations by providing adversary context, collection requirements, analytical judgments, and follow-up hunting recommendations.

• Establish consistent standards for campaign clustering, actor tracking, attribution, analytical confidence, evidence handling, and intelligence validation.

• Build reusable research methods, tools, automation, and investigation playbooks that accelerate the process from initial threat signals to validated findings and customer protection.

• Publish high-quality internal and external research and represent the organization in customer briefings, intelligence-sharing communities, and industry forums.

• Mentor other researchers and strengthen investigative practices through original research and repeatable adversary analysis techniques.

Requirements:

• Extensive experience in cyber threat intelligence, adversary research, threat hunting, malware analysis, incident response, or a closely related discipline, with demonstrated technical leadership as a senior individual contributor.

• Deep understanding of nation-state and cybercriminal activity, ransomware operations, initial-access techniques, malware ecosystems, and vulnerability exploitation.

• Proven experience investigating large-scale endpoint, network, cloud, identity, email, and security operations telemetry using SIEM, EDR, data lake, or comparable analysis platforms.

• Strong analytical and scripting skills, including experience with SQL, Python, Kusto Query Language (KQL), SPL, or similar languages for large-scale data analysis, enrichment, and workflow automation.

• Hands-on experience analyzing host and network telemetry, such as process execution, command-line activity, authentication events, DNS, proxy and firewall logs, Zeek, Sysmon, auditd, and cloud audit records.

• Ability to translate intelligence findings into YARA and Sigma rules, behavioral detections, hunting strategies, incident response actions, defensive controls, or product improvements.

• Working knowledge of MITRE ATT&CK, the Diamond Model, intrusion analysis, structured analytic techniques, campaign clustering, attribution, and analytical confidence.

• Familiarity with malware analysis and reverse-engineering tools such as Ghidra, IDA Pro, x64dbg, debuggers, sandboxes, and static or dynamic analysis utilities.

• Strong technical writing and communication skills, with the ability to produce publication-quality research and explain findings, uncertainty, customer impact, and recommended actions to technical, executive, and customer audiences.

• Sound judgment when handling sensitive intelligence, customer data, uncertain attribution, and high-impact or rapidly evolving security incidents.

• Commitment to security, privacy, and compliance requirements, including the protection of confidential business, customer, and employee information.

• Candidates participating in remote video interviews are expected to keep their cameras on. If technical, bandwidth, or location-related circumstances prevent this, advance notice is required so appropriate accommodations can be discussed.

Benefits:

• Annual base salary range of $86,000–$240,000 USD, depending on skills, experience, location, and job-family level.

• Variable incentive compensation.

• New-hire equity grants and employee equity participation.

• Flexible time off and paid volunteer days.

• 401(k) contributions and matching.

• Comprehensive benefits, including medical, mental health, dental, disability, life, and accidental death and dismemberment (AD&D) coverage, along with additional services.

• Employee Assistance Program (EAP), including mental health support.

• Fertility support and paid parental leave.

• Training and career development programs.

• Employment may be subject to background verification and additional security, regulatory, compliance, or export-control requirements, where applicable.

How Jobgether works:

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1