Threat Intel Manager Jobs

At Jamf, we believe in an open, flexible culture based on respect and trust. Our track record and thriving work environment all stem from the freedom we grant ourselves to get the job done right. We take pride in helping tens of thousands of customers around the globe succeed with Apple. The secret to our success lies in our connectivity, while operating with a high degree of flexibility. Work-life balance remains our priority while feeling connected is important to maintain our strong culture, achieve our goals, and thrive as #OneJamf. This is a hybrid role based in Tel Aviv, Israel, with the expectation to be in the office on Mondays, Tuesdays, and Thursdays. We are only able to accept applications for those based in Israel or have sponsorship to live and work in Israel. #LI-Hybrid What you'll do at Jamf: At Jamf, we empower people to be their best selves and do their best work. Mobile threats are getting more sophisticated. Jamf Mobile Forensics (JMF) gives security teams a remote, efficient way to monitor mobile devices and respond to advanced attacks - and we're growing the engineering team behind it. As a Senior Software Engineer, you wil l lead within an agile team, mentor others, and own complex parts of the product end-to-end. The current focus is compelling: designing for horizontal scalability to support a growing customer base, and expanding Android threat detection to cover a broader range of attack vectors. If you take quality seriously and want to build software that helps organizations protect the devices their people rely on, we'd like to hear from you. Our Tech Stack: Java Spring Boot Linux PostgreSQL Elastic Search Claude Code AWS Docker What you can expect to do in this role: Break down customer problems into work you and the team can execute on. Independently complete tasks from start to finish with high quality. Ability to communicate technical concepts to stakeholders. Use your knowledge of Engine

Job Overview : Seeking Technical Electronic Intelligence (TechELINT) Analyst. Become a member of a highly accomplished ELINT team providing direct support to geographically dispersed USAF Wing and Squadron-level organizations. Perform interpretive pulse-level and P-Cubed analysis of ELINT data, in-depth radar and weapons systems studies, and cutting-edge modeling and simulation efforts. The TechELINT analyst will leverage their aviation, Electronic Warfare experience, and critical-thinking prowess to develop tactics and techniques to counter emerging threats. The analyst will also work and coordinate with DoD entities and agencies to facilitate cutting-edge product development to ensure client capabilities meet current and future objectives. The analyst must possess an in-depth understanding of the key factors in aircraft survivability and combat mission planning to ensure client objectives are met. Primary Responsibilities : Support the collection, documentation, and post-test analysis of ELINT to evaluate programming effectiveness. Use specialized tools to ingest intel data and program ELINT, ensuring integration with EW systems. Work with a team of engineers to collaborate on ELINT products and ensure proper programming in alignment with mission objectives. Design procedures to analyze testing results, ensuring accurate validation and effectiveness of systems. Utilize the latest intel databases to perform detailed analysis and research, identifying potential threats and solutions. Basic Qualifications : Bachelor's degree (or 2-4 additional years of experience) in Intelligence or Information Operations and minimum of 8 years ofTechnical Signals Analysis experience. Experience with intel tools such as ASPEN, WILLOW, MARTES, THRESHER, and GALE. Former Military Experience in Technical Signals Analysis. Active TOP SECRET clearanc

For more than 30 years, SonicWall has delivered a partner-first unified cybersecurity portfolio that helps SMBs, MSPs, and IT teams consolidate network security, endpoint security, security service edge (SSE), and threat response across hybrid environments. By bringing connected technology, real-time threat intelligence, automation, and expert services together, SonicWall helps organizations simplify security operations, achieve better security outcomes, and lower total cost of ownership. Backed by a global ecosystem of more than 17,000 partners, SonicWall delivers enterprise-grade protection built for SMB and mid-market realities. For more information, visit www.sonicwall.com or follow us on X, LinkedIn , Facebook , and Instagram . About the Role SonicWall is hiring a Senior Software Engineer to develop and maintain the Content Filtering Service client embedded in SonicOS — the firmware running on SonicWall firewall appliances worldwide. This module intercepts live traffic, queries the CFS rating servers in real time, and enforces URL-based content filtering policies at the packet level. This is security-critical code: a policy bug is a traffic bypass on a deployed security appliance. The codebase is in C with a split Control Plane / Data Plane architecture, multi-blade cache synchronization, and multiple firmware version upgrade paths. Responsibilities Maintain, harden, and extend the CFS client module across both the control plane and data plane. Own the binary UDP protocol implementation between the firewall and the CFS rating servers, ensuring correctness and compatibility across protocol versions. Develop and maintain complete IPv4 and IPv6 support across all code paths. Own the firmware upgrade and migration paths, ensuring they are atomic, failure-safe, and correctly handle all supported version transitions. Improve reliability of inter-blade cache synchronization on multi-blade appliances. Collaborate with the server-side on coordinated

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As an Threat Research Engineer at GitLab, you'll research emerging security threats and turn your findings into protection for GitLab customers. You'll investigate new attack surfaces, including AI coding agents, agent plugins, and package ecosystems, and build systems that help detect threats and improve vulnerability advisories. This is a full-stack role: you'll take an idea from the first research question to a working proof of concept, deploy it, and analyze the results yourself. Artificial intelligence (AI) is central to how we work. You'll use AI tools daily and build agentic workflows for research,

Threat Hunter / Purple Team Operator SIXGEN's mission is to deliver agile, mission-ready cybersecurity solutions that empower government and critical infrastructure organizations to stay ahead of advanced cyber threats. We combine innovation, deep expertise, and leading technical capabilities to uncover vulnerabilities, protect vital systems, and strengthen operational resilience. POSITION OVERVIEW Position: Mid-Level Threat Hunter / Purple Team Operator Job Type: Full Time Location: Remote with travel to customers and test locations as required Clearance Requirement: Active Top Secret with SCI eligibility Salary Range ; $115-$140K WHAT YOU'LL DO SIXGEN is seeking a mid-level Threat Hunter / Purple Team Operator to identify threats that evade existing detection methods, develop and test hunting hypotheses, and feed findings back into detection engineering. This role will combine remote threat hunting and on-site purple team coordination in direct support of red team engagements to secure systems, strengthen the defenders, and build and validate detection methods that can catch offensive traffic in real time. This role requires comfort working independently through remote hunts as well as the ability to translate adversary tradecraft into defensive guidance. Responsibilities include: Conduct hypothesis-driven and intelligence-led threat hunts across endpoints, networks, and cloud telemetry for several weeks prior to each red team engagement. Analyze logs, alerts, and historical data for indicators of compromise (IOCs), anomalous behavior, and adversary TTPs mapped to the MITRE ATT&CK from partner-provided sources (EDR, SIEM, authentication/identify logs). Document hunt coverage and methodology, findings, detection recommendations, and any confirmed or suspected compromise, escalating immediately if active adversary activity is found. Deliver a threat hunt summary and determine if the customer environment is clear prior to red team assessments. Partner with

CLEAR is building THE secure identity company of the future. Our mission is to make experiences safer and easier—physically and digitally. With more than 43 million Members and a growing network of partners across the world, CLEAR's secure identity platform is transforming the way people live, work, and travel. Whether it’s at the airport, stadium, or throughout your everyday life, CLEAR unlocks the magic of frictionless experiences. CLEAR is seeking a Threat Detection Analyst III to join our SOC team to help strengthen our ability to detect, investigate, and respond to evolving security threats. In this role, you’ll lead complex investigations, improve CLEAR’s threat detection and response capabilities, and serve as a trusted security partner while helping develop the analysts and program around you. What you'll do: Lead complex investigations of security events across corporate networks, endpoints, data centers, cloud environments, and other critical systems, driving incidents from initial analysis through escalation and remediation Develop, tune, and optimize threat detection logic across SIEM, EDR, and other security platforms, proactively identifying coverage gaps, reducing false positives, and improving the fidelity of security alerts Partner with Engineering, Infrastructure, and other teams to investigate threats, identify root causes, communicate risk, and drive timely remediation and improvements to CLEAR’s security posture Apply threat intelligence, data, automation, and AI-enabled tools to identify emerging attack patterns, accelerate investigations, improve detection workflows, and strengthen decision-making while applying sound security judgment Serve as a subject matter expert and escalation point for other analysts, mentoring junior team members, sharing knowledge, and helping establish scalable processes, playbooks, and standards for threat detection and analysis Continuously evaluate CLEAR’s detection coverage against the evolving threat land

Ready to do the most impactful work of your career? At Coinbase , we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase . As a Threat Intelligence Platform Engineer on the Threat Intelligence team within Security Operations, you'll own Vertex Synapse in production - the platform that turns adversary intelligence into detections, blocks, and decisions across Coinbase. The TI team protects billions of dollars in digital assets by collecting, modeling, and operationalizing intelligence on the most sophisticated cyber threats targeting the crypto ecosystem. You'll keep the platform healthy, ingest and model new intelligence sources, and ship the automations that weave threat intelligence into the fabric of security operations at Coinbase. What you'll do: Own the production Vertex Synapse instance, including platform health, backend operations, cron monitoring, and data hygiene Build and maintain intelligence feed integrations, enrichments, and tagging so new sources land modeled and usable by stakeholders Ship intelligence into downstream controls and data pipelines, including detections, blocklists, data warehouses, and agent workflows Partner across Security and Product to translate intelligence requirements into production capabilities Rapidly prototype and implement features, fixes, and tooling as required by the team's Intelligence Analysts and stakeholders Required Skills and Experience: 2+ years building and operating threat intelligence platforms or security data pipelines in produc

Threat and Vulnerability Management Engineer

About us GoCardless, a Mollie company, is a global leader in bank payments. Over 100,000 businesses, from start-ups to household names, use GoCardless to collect, manage and send bank payments through Direct Debit, real-time payments and open banking. With US$130bn+ processed annually across 30+ countries, we handle recurring and one-off payments without the chasing, stress, or expensive fees. Our end-to-end payment platform also features AI-powered solutions to improve payment success and reduce fraud, alongside connections to over 350 platforms businesses use everyday. We are headquartered in the UK, with teams and operations spanning North America, Europe and Asia-Pacific. For more information, please visit www.gocardless.com and follow us on LinkedIn @GoCardless. Mollie is the leading payments and financial services partner for business, rooted in Europe, with global reach. The role The Threat & Analytics Lead builds GoCardless's data-driven understanding of fraud and financial crime risk. You'll bring specialist analytical expertise to both domains, helping the business understand emerging threats, measure how well existing controls are working, and identify where prevention and detection need to get stronger. Your evidence and insights will inform our strategy and how we prioritise our investments. You'll work closely with Product, Engineering, Operations and Data Science to analyse large, complex datasets and surface patterns, trends and risk concentrations across the customer lifecycle, spanning fraud prevention, transaction monitoring, sanctions screening, customer risk management and broader financial crime work. You’ll work hand-in-hand with the teams who own fraud and financial crime strategy, governance, policy and operational delivery. The Threat & Analytics Lead is a senior-level role with a high level of complexity, autonomy and expectation of impact. What excites you Getting to the root cause of problems — not just r

SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: Threat Disruption provides expert threat intelligence and conducts scaled operations against the adversaries attacking X. We investigate and disrupt threats across the following areas: Platform manipulation, including coordinated networks of bots attempting to pollute the information space Compromises of accounts owned by high-visibility individuals and organizations Sensitive allegations carrying reputational, legal, or geopolitical weight, including suspected foreign-linked influence campaigns Financial fraud, monetization abuse, and scam networks operating on and off X Other X Rules violations, including illegal activity and child safety We identify how adversaries circumvent our defenses, abuse product features and core services, and benefit from the abuse. Based on these investigations, we conduct sweeps to disrupt immediate threats and provide recommendations to product, engineering, and policy teams to squash systemic vulnerabilities. Where appropriate, Threat Disruption also coordinates with law enforcement and other external parties to enhance detections and support prosecution of bad actors. Come help us defend the global town square. RESPONSIBILITIES:

SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: Threat Disruption provides expert threat intelligence and conducts scaled operations against the adversaries attacking X. We investigate and disrupt threats across the following areas: Platform manipulation, including coordinated networks of bots attempting to pollute the information space Compromises of accounts owned by high-visibility individuals and organizations Sensitive allegations carrying reputational, legal, or geopolitical weight, including suspected foreign-linked influence campaigns Financial fraud, monetization abuse, and scam networks operating on and off X Other X Rules violations, including illegal activity and child safety We identify how adversaries circumvent our defenses, abuse product features and core services, and benefit from the abuse. Based on these investigations, we conduct sweeps to disrupt immediate threats and provide recommendations to product, engineering, and policy teams to squash systemic vulnerabilities. Where appropriate, Threat Disruption also coordinates with law enforcement and other external parties to enhance detections and support prosecution of bad actors. Come help us defend the global town square. RESPONSIBILITIES:

About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the Role We are looking for a Threat Intelligence Engineer to join our Threat Intelligence team. In this role, you will build the infrastructure that powers our threat discovery capabilities—integrating external data sources, developing detection systems for automated lead generation, and creating internal tooling that scales our investigators' impact. This is a foundational engineering role on a small, high-impact team. You will take projects from proof-of-concept to production, work closely with investigators to understand their needs, and help scale what may become a multi-person collections function. Responsibilities: Build automated detection systems that use disparate signals to identify abusive behavior. Take systems from idea to proof-of-concept to production-grade with appropriate monitoring, documentation, and maintenance processes Develop and maintain YARA rule infrastructure, including tools for writing, validating, and testing rules against real data Create integrations with external threat intelligence platforms (e.g. VirusTotal, Censys, Urlscan) via MCP servers to enable multi-source correlation during investigations Build data pipelines that ingest intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries Develop behavioral analytics capabilities using DBT-based frameworks and create searchable audit logging infrastructure Establish feedback loops with investigators to tune detection systems and reduce false positives Scrape and normalize data from external sources to feed threat detection and enrichment workflows You may be a good

About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations Austin, US London, UK About the Role Cloudforce One is Cloudflare’s threat operations and research team, responsible for identifying and disrupting cyber threats ranging from sophisticated cyber criminal activity to nation-state sponsored advanced persistent threats (APTs). Cloudforce One works in close partnership with external organizations and internal Cloudflare teams, continuously developing operational tradecraft and expa

CAPCO POLAND *We are looking for candidates willing to relocate to the Middle East - Qatar for the duration of the project. At Capco Poland, we’re not just another consultancy - we’re the spark behind digital transformation in the financial world. As a global leader in technology and management consulting, we thrive on helping clients tackle the toughest challenges across banking, payments, capital markets, wealth, and asset management. Our secret? A culture that’s fast, flexible, and fiercely entrepreneurial. We move quickly, think creatively, and always put our people first. We’re passionate about growth - both for our clients and ourselves - and that means attracting the very best talent to join us on this exciting journey. We’re proud to be: • Trailblazers in banking, payments, capital markets, wealth, and asset management • Champions of an agile, nimble, and innovative work environment • Dedicated to building a team of top-notch professionals who share our drive and vision The Role Capco is looking for a Security Consultant to help our clients identify, assess, and manage cybersecurity threats and technology risks across complex environments. You’ll work with security, technology, risk, architecture, and business teams to deliver structured threat and risk assessments that support informed decision-making and effective security controls. This is an opportunity to work on complex cybersecurity challenges within financial services, helping clients understand their threat landscape, identify vulnerabilities and control gaps, and strengthen their overall security and technology risk posture. The engagement is expected to run for one year and requires relocation to the Middle East for its duration . You will collaborate with client and project teams to deliver the agreed data engineering scope and project outcomes. What You’ll Do Assess existing security controls and evaluate their effectiveness against identified cyber and technology risks

Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange platform protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Distributed across 200+ public data centers globally and thousands of private sites at the edge, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform. We believe the future of work is Human + AI and are building an AI-native enterprise where human potential is amplified by machine intelligence to solve the world’s hardest security challenges. Driven by deep customer obsession, we are committed to the mission, outcome, and to each other. We bring these commitments to life through three core behaviors: ownership and collaboration, trust through outcomes and impact, and a challenge culture with ongoing feedback. Ready to make an impact at the company pioneering security transformation in the AI era? Join us at Zscaler. Role We are looking for a Staff Threat Researcher to join our team. This is a remote role, reporting to the Manager Threat Research in the Threat Research Team. As our Staff Threat Researcher, you will serve as a highly technical subject matter expert on adversary tradecraft across endpoint, cloud, and identity environments. You will apply formal research methodologies to dissect and replicate complex cyber attacks, answering the critical questions of exactly how techniques work and how we can best detect them. By transforming your deep technical discoveries into practical attack automations and scalable detection recommendations, you will bridge the gap between theoretical research and operational defense. In this role, your expertise will directly strengthen our defensive capabilities, inform our detection engineering priorities, contribute to broader product strategy, and keep our customers a step ahead of evolving evasi