Security Threat Intelligence Analyst Jobs

About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research, and infrastructure by proactively identifying and disrupting adversaries who seek to compromise our systems or misuse our models. We investigate sophisticated threats, build tooling to scale and augment analysis, and deliver intelligence that shapes security strategy and equips leadership with timely, risk-aware insights. We combine technical depth, investigative rigor, and strong cross-functional partnerships to uncover threats and drive impact across OpenAI’s security and research organizations. About the Role As a Technical Threat Investigator at OpenAI, you will help protect the company from sophisticated adversaries targeting OpenAI and the broader ecosystem, as well as those attempting to misuse our models in support of cyber operations. This is a deeply investigative role. You will independently conduct complex, end-to-end investigations into capable threat actors to understand their behavior, infrastructure, emerging techniques, and how AI is integrated into their workflows. You’ll use these insights to proactively identify malicious activity and drive detection, disruption, enforcement, and safety improvements across the company. You’ll translate your investigative findings into durable solutions that scale impact. You’ll build and own lightweight tooling, automate where it matters, and create AI-assisted workflows to make investigations faster, more repeatable, and more effective over time. In this role, you will: Conduct deep, end-to-end investigations into sophisticated threat actors interacting with OpenAI’s models, products, and broader ecosystem. Think like an adversary — model attacker behavior, anticipate misuse patterns, and proactively hunt for, identify, and disrupt malicious activity. Leverage internal telemetry, OSINT, vendor data, a

About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research, and infrastructure by proactively identifying and disrupting adversaries who seek to compromise our systems or misuse our models. We investigate sophisticated threats, build tooling to scale and augment analysis, and deliver intelligence that shapes security strategy and equips leadership with timely, risk-aware insights. We combine technical depth, investigative rigor, and strong cross-functional partnerships to uncover threats and drive impact across OpenAI’s security and research organizations. About the Role As a Technical Threat Investigator at OpenAI, you will help protect the company from sophisticated adversaries targeting OpenAI and the broader ecosystem, as well as those attempting to misuse our models in support of cyber operations. This is a deeply investigative role. You will independently conduct complex, end-to-end investigations into capable threat actors to understand their behavior, infrastructure, emerging techniques, and how AI is integrated into their workflows. You’ll use these insights to proactively identify malicious activity and drive detection, disruption, enforcement, and safety improvements across the company. You’ll translate your investigative findings into durable solutions that scale impact. You’ll build and own lightweight tooling, automate where it matters, and create AI-assisted workflows to make investigations faster, more repeatable, and more effective over time. In this role, you will: Conduct deep, end-to-end investigations into sophisticated threat actors interacting with OpenAI’s models, products, and broader ecosystem. Think like an adversary — model attacker behavior, anticipate misuse patterns, and proactively hunt for, identify, and disrupt malicious activity. Leverage internal telemetry, OSINT, vendor data, a

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk and Product Engineering to run rigorous experiments, balancing aggressive risk mitigation against legitimate user conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites in partnership with Abuse Research to permanently block threat recurrence and seamlessly transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the Abuse Control Engineering (ACE) team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. Where emerging threat patterns identify Stripe product weaknesses, ACE steps in to rapidly build and experiment with technical safeguards. Driven by empirical evidence and Stripe’s FT3 (Fraud Taxonomy 3.0) framework, you will translate threat intelligence into hard technical control requirements (e.g., API rate-limiting, step-up challenges, parameter validation, pre-debit holds). You will carefully balance security and product velocity, running experiments to evaluate risk reduction against user conv

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation life

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE uses real-world attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk, Abuse Research, and Product Engineering to run rigorous experiments that balance effective risk mitigation with legitimate user activity and conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites to prevent threats from recurring and transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the ACE team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. When emerging threat patterns reveal weaknesses in Stripe products, ACE rapidly builds and experiments with technical safeguards. Guided by empirical evidence and Stripe’s Fraud Taxonomy 3.0 (FT3) framework, you will translate threat intelligence into precise technical control requirements, such as API rate limits, step-up challenges, parameter validation, and pre-debit holds. You will run experiments to evaluate risk reduction against the impact on legitimate user conversion, carefully balancing security and product velocity. You will manage controls through a structured incubation life

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team Abuse Control Engineering (ACE) is Stripe’s rapid-response technical defense and control incubator. When urgent abuse vectors emerge, ACE bridges the gap using real attacker telemetry to prototype, test, and deploy software safeguards before vulnerabilities can be exploited at scale. We partner closely with Fraud, Risk and Product Engineering to run rigorous experiments, balancing aggressive risk mitigation against legitimate user conversion. Operating as both a strike team and an incubator, ACE builds automated regression suites in partnership with Abuse Research to permanently block threat recurrence and seamlessly transfers mature controls to long-term product owners across Stripe. What you’ll do As an Abuse Control Engineer on the Abuse Control Engineering (ACE) team, you will design, prototype, and incubate technical defenses that safeguard Stripe’s financial ecosystem against complex, cross-cutting abuse vectors. Where emerging threat patterns identify Stripe product weaknesses, ACE steps in to rapidly build and experiment with technical safeguards. Driven by empirical evidence and Stripe’s FT3 (Fraud Taxonomy 3.0) framework, you will translate threat intelligence into hard technical control requirements (e.g., API rate-limiting, step-up challenges, parameter validation, pre-debit holds). You will carefully balance security and product velocity, running experiments to evaluate risk reduction against user conversion impact.

As Engineering Manager for Threat Detection, you will lead a high-performing team that powers Datadog's detection program. Threat Detection is the organization responsible for keeping Datadog ahead of an evolving threat environment: closing coverage gaps faster, raising the bar on signal quality, and shipping detections that hold up under the scale and complexity of cloud-native infrastructure. Your team will combine direct detection expertise, platform engineering, and applied AI to ship detections at a pace and scale traditional rule-writing alone cannot match. Examples of what your team will work on include detection-authoring agents, the detection platform that powers every rule in production, coverage analysis, alert triage and response automation, and the evaluation infrastructure that holds these systems to a high bar of fidelity. Detection authorship is a shared responsibility across the organization, and your team will contribute both by building the systems that scale our authoring capacity and by writing detections directly when their domain expertise is the right tool. You will partner closely with our Security Incident & Response Team (SIRT), Cyber Threat Intelligence (CTI), AI Engineering teams, and Datadog's broader Security organization. This is a high-impact leadership role: you will grow a team of security and software engineers responsible for building and executing our detection and AI strategy. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the strategy, roadmap, and execution of Datadog Security's shift to AI-accelerated detection and response. Drive development of high-fidelity detections as a shared responsibility across the organization, ensuring your team's systems and direct contributions raise the bar on coverage and

Security Operations Specialist A Career with Point72's Technology Team As Point72 reimagines the future of investing, our Technology team is constantly evolving our firm’s IT infrastructure and engineering capabilities, positioning us at the forefront of a rapidly evolving technology landscape. We’re a team of experts who experiment and work to discover new ways to harness open-source solutions, modern cloud architectures, and sophisticated Artificial Intelligence (AI) solutions, while embracing enterprise agile methodologies. Our commitment to building and innovating in the AI space provides the framework intended to drive smarter decision making and enhance how we build and operate our platforms and applications. As a member of Point72’s Technology team, we encourage and support your professional development from day one—helping you advance your technical skills, contribute innovative ideas, and satisfy your own intellectual curiosity—all while delivering real business impact for our multi-billion-dollar global business. WHAT YOU’LL DO Lead investigations into sophisticated cyber threats and shape defensive actions that protect the critical technology environment at the firm Serve as incident commander for high or critical incidents by coordinating response actions, driving timely decisions, and keeping stakeholders aligned Analyze and correlate security telemetry, log data, and threat intelligence to identify malicious activity and determine organizational impact Develop threat intelligence reports that explain findings, mitigations, confidence levels, and implications for security operations Create dashboards and visualizations that help security teams detect patterns, prioritize risks, and improve response decisions Hunt for advanced adversary activity by applying analytics, network diagrams, and system knowledge to identify hidden threats Partner with development teams to define requirements and enhancements for security capabilities, analytics, and operationa

About the role Adobe’s Security Data Platform team builds and operates a petabyte-scale security data lakehouse that turns enterprise telemetry into trusted data for threat detection, investigations, compliance, and security analytics. As a Staff Security Data Engineer, you will own full-system designs and lead critical engineering initiatives across ingestion, storage, governance, orchestration, and data serving. This is a hands-on individual contributor role: you will write and review production code, build infrastructure, define test strategy, fix complex failures, and work with other engineers to deliver the architecture you help shape. You will partner with Security Operations, Threat Intelligence, Compliance, Security Engineering, and infrastructure teams to resolve technical tradeoffs and deliver reliable, cost-effective platform capabilities. Your impact will come through engineering delivery, sound architectural decisions, and helping others become stronger technical leaders. Help us evolve our team from petabyte scale toward exabyte scale! Core responsibilities Platform architecture and engineering Own end-to-end designs that shape the Security Data Platform’s fundamental architecture on Databricks and AWS, using Spark, Delta Lake, and Unity Catalog. Translate ambiguous needs into design proposals, implementation plans, and production capabilities. Build and evolve distributed batch and streaming pipelines for EDR telemetry, network logs, identity events, cloud audit logs, and new security data sources. Design for throughput, fault tolerance, replay, schema evolution, and sub-minute freshness where use cases require it. Write maintainable Python and SQL, develop complex platform features, and refactor unreliable code. Establish reusable engineering patterns, lead code and design reviews, and own test strategy and automation choices across pipelines and infra

RDQ226R605 This role can be based remotely anywhere in the United States. About Databricks Databricks is the data and AI company. More than 12,000 organizations worldwide — including Comcast, Condé Nast, Grammarly, and over 50% of the Fortune 500 — rely on the Databricks Data Intelligence Platform to unify and democratize data, analytics and AI. Databricks is headquartered in San Francisco, with offices around the globe and was founded by the original creators of Lakehouse, Apache Spark™, Delta Lake and MLflow. About the Team The Agentic Security Engineering team is a horizontal, shared services engineering team that makes every Databricks security function AI-native — building the AI agents, "personas," and shared platform that security teams across the org (Detection & Response, Threat Intelligence, Vulnerability & Product Security, Red Team, GRC, and Continuous Monitoring) build on to operate at machine speed, safely and reliably. We leverage AI to transform how security is done. The Role As Staff Security Software Engineer , you own a major technical workstream designing and shipping production-grade AI agents and the platform capabilities that power them, with reliability, observability, and safe-by-default security as first-class requirements. You set the standards for how agents are built and operated and co-build with partner security teams. Example use cases you'll enable, led by AI threat detection at scale (alert triage and false-positive reduction, fleet-scale anomaly detection), extend to threat hunting, vulnerability management, product security, red team/offensive testing, and GRC/assurance use cases. The Impact You Will Have Agentic Security Engineering Architecture Design, ship, and operate production AI agents/personas that security teams depend on, starting with AI threat detection at scale. Build and harden the shared platform so any security team can ship agents safely and reliably — i.e., sandboxing, scoped least-privilege identity, obs

Role Summary We are seeking an experienced SOC / Security Operations Lead to oversee and strengthen the organization's Security Operations Center (SOC), threat detection, incident response, vulnerability management, data protection, and security monitoring capabilities. The ideal candidate will possess extensive experience in managing enterprise security operations, SIEM/SOAR platforms, threat hunting, incident response, DLP, endpoint security, and vulnerability management programs. The role requires leadership of a multi-functional security operations team responsible for protecting critical business systems, customer data, and digital assets while ensuring compliance with RBI regulations and industry security standards. Key Responsibilities Security Operations Center (SOC) Management -Lead and manage 24x7 Security Operations Center (SOC) functions. -Establish and enhance SOC processes, playbooks, escalation procedures, and operational metrics. -Ensure timely detection, triage, investigation, containment, and remediation of security incidents. -Develop SOC maturity roadmaps aligned with industry best practices and regulatory expectations. -Monitor security KPIs, SLAs, MTTR, MTTD, and incident response effectiveness. SIEM, XSIAM & Threat Detection -Lead implementation, administration, and optimization of: -Palo Alto Cortex XSIAM -SIEM Platforms -SOAR Platforms -UEBA Solutions -Threat Intelligence Platforms -Develop and tune correlation rules, detection logic, and analytics use cases. -Enhance detection coverage across cloud, endpoints, applications, networks, and third-party environments. -Drive threat hunting and proactive security monitoring initiatives. Incident Response & Threat Management -Lead enterprise cyber incident response activities. -Develop and maintain incident response plans, runbooks, and communication procedures. -Coordinate investigations involving malware, ransomware, phishing, insider threats, account compromise, fraud, and adv

About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone’s reach while doing the most important work of your career. About the team The Security Incident Response team works to analyze, investigate, and respond to threats before they impact Stripe’s business or users. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed, working across multiple AMER time zones, and will regularly coordinate with stakeholders in EMEA and APAC. What you’ll do You will leverage your security engineering experience to improve incident response capabilities at Stripe. With an emphasis on user and entity behavior analytics, as well as endpoint hardening, you will gain a deep understanding of Stripe’s systems, tooling, and workflows to be able to differentiate between legitimate and malicious activity. Using both threat intelligence and collected telemetry, you will guide and build Stripe-specific signals enrichment logic and incident response solutions that scale with our company. Lastly, your analytic capabilities will be critical during security incidents to reduce uncertainty, uncover root causes, and inform future prevention and detection mechanisms. Responsibilities Analyze and inv

For more than 30 years, SonicWall has delivered a partner-first unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network security, endpoint security, security service edge (SSE), and threat response across hybrid environments. By bringing connected technology, real-time threat intelligence, automation, and expert services together, SonicWall helps organizations simplify security operations, achieve better security outcomes, and lower total cost of ownership. Backed by a global ecosystem of more than 17,000 partners, SonicWall delivers enterprise-grade protection built for SMB and mid-market realities. For more information, visit www.sonicwall.com or follow us on X, LinkedIn , Facebook , and Instagram . Role Overview As our lead AI/ML Engineer , you will design, build, and scale the intelligence layer powering our next-generation security products. You will turn complex datasets—including configurations, security alerts, and raw network logs—into production-ready AI capabilities that drive automated analysis, reasoning, and intelligent recommendations. Key Responsibilities Architect AI Systems: Design and deploy robust Retrieval-Augmented Generation (RAG) pipelines, agentic workflows, and LLM applications tailored to parse and reason over security telemetry and unstructured logs. Model Development & Tuning : Train, fine-tune, and evaluate ML/DL models for pattern matching, anomaly detection, and classification across massive, heterogeneous security datasets. Ensure AI Trust & Alignment : Implement strict guardrails, evaluation frameworks, and safety alignment techniques to ensure all model outputs and recommendations are deterministic, safe, and highly accurate. Establish MLOps: Build and maintain scalable ML pipelines (from data preprocessing to model monitoring in production), collaborating closely with Data and Product Engineers to ensure low-latency, secure inferences. Required Experience & Ski

For more than 30 years, SonicWall has delivered a partner-first unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network security, endpoint security, security service edge (SSE), and threat response across hybrid environments. By bringing connected technology, real-time threat intelligence, automation, and expert services together, SonicWall helps organizations simplify security operations, achieve better security outcomes, and lower total cost of ownership. Backed by a global ecosystem of more than 17,000 partners, SonicWall delivers enterprise-grade protection built for SMB and mid-market realities. For more information, visit www.sonicwall.com or follow us on X, LinkedIn , Facebook , and Instagram . Roles & Responsibilities Design, deploy, and manage AWS cloud infrastructure and Kubernetes (EKS) environments. Build, maintain, and optimize GitLab CI/CD pipelines for automated deployments. Implement DevSecOps best practices, including infrastructure security, vulnerability management, and compliance controls. Monitor, troubleshoot, and improve platform reliability, performance, and scalability. Deploy and manage cloud-native applications, databases, and supporting services. Collaborate with development teams on architecture, deployment strategies, and production readiness. Drive infrastructure automation using Infrastructure as Code (Terraform). Support incident management, root cause analysis, and operational excellence initiatives. Mandatory Requirements 6+ years of hands-on DevOps/DevSecOps experience in production environments. Strong expertise with AWS services including EKS, EC2, S3, CloudFront, WAF, Lambda, and VPC. Minimum 3+ years of Kubernetes experience, preferably Amazon EKS. Hands-on experience building and managing GitLab CI/CD pipelines. Strong Linux administration and troubleshooting skills. Experience with Infrastructure as Code using Terraform. Proficiency in Python for automation and scriptin

About Ubiquiti At Ubiquiti Inc., we create technology platforms for Businesses, Smart Homes, and Internet Service Providers, driven by our goal to connect everyone, everywhere. To date, Ubiquiti has shipped over 100 million devices worldwide, from ISP networking products to next generation of IT solutions. Our growth is made possible by the dedicated team of hundreds behind the scenes. From software developers and product managers to designers and strategists, Team UI is driven to achieve our common goal: Rethinking IT. At Ubiquiti, you’ll heighten your potential and broaden your horizons - all while shaping the future of connectivity. Responsibilities Design, develop, and maintain network security features, including antivirus, SSL inspection, IDS/IPS, and content filtering in enterprise router firmware and software stacks. Develop deep packet inspection (DPI) and signature-based detection engines for identifying malware, exploits, and malicious traffic patterns. Integrate threat intelligence feeds and update mechanisms to ensure detection of evolving security threats. Ensure high-performance packet processing and minimal latency for real-time threat detection. Collaborate with product managers and system architects to define the security roadmap and feature priorities. Work with QA and DevOps teams to design test cases, validation frameworks, and automated regression testing for security features. Conduct vulnerability analysis, performance benchmarking, and optimization for security modules. Stay current with network security standards, protocols, and emerging threats. Requirement 5+ years of experience in embedded or network security software development. Understanding or hands-on experience with: SSL/TLS inspection and secure proxy implementations IDS/IPS, DPI, and packet inspection engines Content filtering via DNS restriction Antivirus and sandboxing Proficiency in C/C++, with strong knowledge of Linux networking stack and kernel modules. Familiarity wit