Threat Investigator Jobs

Our Purpose Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential. Title and Summary Lead Threat Intelligence Analyst Overview This is an exciting position for a Lead Threat Intelligence Analyst to join Vocalink’s dedicated Threat Intelligence function. You will be play an integral leading role in the Vocalink Threat Intelligence Team, working closely with the SOC and internal security teams to deliver actionable intelligence. You will support a diverse range of customers and contribute to key initiatives such as threat hunting, vulnerability management, and insider threat detection. Collaboration is at the heart of this position. You will work alongside Mastercard’s global threat intelligence capabilities and engage proactively with a wide network of stakeholders, including vendors, industry groups, our customers, and government organisations. This is a unique chance to help shape and grow a fast-evolving threat intelligence capability that serves Vocalink and its customers. If you are passionate about cyber security and eager to make an impact, this role offers an exciting platform to develop your leadership expertise and to help to grow and mature a threat intelligence function in a critical national infrastructure provider. Role Lead the day-to-day operations of the threat intelligence function within the Vocalink Security Operations Cent

Senior Threat Intelligence Analyst — Waterloo, Belgium. Apply via Workday.

About Us At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world’s largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine’s Top Company Cultures list and ranked among the World’s Most Innovative Companies by Fast Company. At Cloudflare, we’re not looking for people who wait for a polished roadmap; we’re looking for the builders who see the cracks in the Internet that everyone else has simply learned to live with. We value candidates who have the instinct to spot a "normalized" problem and the AI-native curiosity to create a solution using the latest tools. Our culture is built on iteration, leveraging AI to ship faster today to make it better tomorrow, while ensuring that every improvement, no matter how small, is shared across the team to lift everyone up. If you’re the type of person who values curiosity over bureaucracy, and that AI is a partner in solving tough problems to keep the Internet moving forward, you’ll fit right in. Available Locations Austin, US About the Role Security at Cloudflare is a focused team committed to helping secure both Cloudflare and our customers. The Threat Detection Automation and Intelligence Team is responsible for identifying, understanding and detecting threats to Cloudflare. We are seeking an experienced Threat Intelligence Engineer with experience with machine learning data science to join our proactive security team. This role is a cr

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. Overview of the role We're looking for a seasoned Threat Intelligence Engineer to join us as a dedicated Senior Security Engineer, TI. You'll be joining a program established a couple of years ago, with a solid foundation already in place: reporting templates, tooling, feeds, and industry connections built out by the Security Operations team over that time. Your mission will be to provide actionable intelligence that empowers GitLab to make informed, proactive decisions about security. We want to get in front of threats before they materialize - using intelligence to see around corners and anticipate the next attack. We'll

Ready to do the most impactful work of your career? At Coinbase , we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase . We're hiring a Regional Threat Assessment Manager to join the Protective Intelligence program within Coinbase's Security organization. This team protects Coinbase employees, executives, facilities, and operations by identifying, assessing, and mitigating threats through intelligence-led case management and structured behavioral assessment. You'll serve as the regional lead and subject matter expert for Threat Assessment and Management, owning complex and sensitive threat cases end-to-end while partnering with GSOC, Executive Protection, Legal, HR/ER, Insider Threat, and other stakeholders to drive coordinated response and help mature the program's regional capabilities. What you'll do: Own end-to-end threat case management for your region, from intake, triage, and behavioral assessment through mitigation planning, documentation, and closure for threats impacting employees, executives, facilities, and other Coinbase assets. Lead structured behavioral threat assessments using Coinbase methodologies and accepted frameworks (e.g., JACA, WAVR-21, CTAP-25) to evaluate motivation, capability, escalation indicators, and stabilizers, then translate findings into clear operational recommendations. Drive intelligence-led incident response by serving as the intelligence lead during active incidents, coordinating with GSOC, ensuring timely escalation, and delivering decision supp

Ready to do the most impactful work of your career? At Coinbase , we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase . We're hiring a Regional Threat Assessment Manager to join the Protective Intelligence program within Coinbase's Security organization. This team protects Coinbase employees, executives, facilities, and operations by identifying, assessing, and mitigating threats through intelligence-led case management and structured behavioral assessment. You'll serve as the regional lead and subject matter expert for Threat Assessment and Management, owning complex and sensitive threat cases end-to-end while partnering with GSOC, Executive Protection, Legal, HR/ER, Insider Threat, and other stakeholders to drive coordinated response and help mature the program's regional capabilities. What you'll do: Own end-to-end threat case management for your region, from intake, triage, and behavioral assessment through mitigation planning, documentation, and closure for threats impacting employees, executives, facilities, and other Coinbase assets. Lead structured behavioral threat assessments using Coinbase methodologies and accepted frameworks (e.g., JACA, WAVR-21, CTAP-25) to evaluate motivation, capability, escalation indicators, and stabilizers, then translate findings into clear operational recommendations. Drive intelligence-led incident response by serving as the intelligence lead during active incidents, coordinating with GSOC, ensuring timely escalation, and delivering decision supp

Ready to do the most impactful work of your career? At Coinbase , we are uncompromising on our mission to increase economic freedom. The bar is high, the environment is intense, and we like it that way. This isn't a place for complacency, it’s a place to be pushed past your perceived limits. If you're ready to build the future of finance alongside people who refuse to settle for "good enough," you belong here. Coinbase is a remote-first, but not remote-only company. Expect to get together quarterly for intense in-person working sessions called “surges.” learn more about working at Coinbase . We're hiring a Regional Threat Assessment Manager to join the Protective Intelligence program within Coinbase's Security organization. This team protects Coinbase employees, executives, facilities, and operations by identifying, assessing, and mitigating threats through intelligence-led case management and structured behavioral assessment. You'll serve as the regional lead and subject matter expert for Threat Assessment and Management, owning complex and sensitive threat cases end-to-end while partnering with GSOC, Executive Protection, Legal, HR/ER, Insider Threat, and other stakeholders to drive coordinated response and help mature the program's regional capabilities. What you'll do: Own end-to-end threat case management for your region, from intake, triage, and behavioral assessment through mitigation planning, documentation, and closure for threats impacting employees, executives, facilities, and other Coinbase assets. Lead structured behavioral threat assessments using Coinbase methodologies and accepted frameworks (e.g., JACA, WAVR-21, CTAP-25) to evaluate motivation, capability, escalation indicators, and stabilizers, then translate findings into clear operational recommendations. Drive intelligence-led incident response by serving as the intelligence lead during active incidents, coordinating with GSOC, ensuring timely escalation, and delivering decision supp

Reports to: Senior Manager, Detection Engineering & Threat Hunting Location: Remote Australia Compensation Range: $150,000 to $170,000 AUD base plus bonus and equity What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 5M+ endpoints and 15M+ identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. What You’ll Do: Members of the Huntress DE&TH team wake up every morning with the honor of impeding threat actors through a combination of detection engineering and threat hunting. This team sits alongside our 24x7 Security Operations Center, and our Adversary Tactics & Tactical Response function, and plays a pivotal role in detecting threats actors before they get a chance to impact our partner environments. As a Senior Detection Engineering and Threat Hunting (DE&TH) Analyst you should be drawn to the hard problems: detecting stealthy intrusions, managing false positives and false negatives at scale, and uncovering clues that may expose an evolving campaign across Huntres

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world's largest enterprises to the most ambitious startups—use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team The Proactive Threat team is responsible for identifying vulnerabilities and security weaknesses across Stripe's systems, applications, networks, and cloud infrastructure — before adversaries do. We operate as a hybrid offensive function: conducting penetration testing, emulating real-world threat actors through red team operations, and partnering closely with our defensive security teams to validate detection capabilities and improve Stripe's overall security posture. We are builders first. Our team develops custom tooling, automation frameworks, and internal platforms that scale our offensive capabilities and enable repeatable, high-fidelity assessments. We believe the best offensive security engineers are equal parts hacker and engineer. The team is distributed across the United States, primarily operating in Eastern and Pacific time zones, and collaborates regularly with security, engineering, and product stakeholders across Stripe — including teams in Europe and Asia. What you'll do As an Offensive Security Engineer on the Proactive Threat team, you will simulate the tactics, techniques, and procedures (TTPs) of real-world adversaries to uncover security risks across Stripe's products and infrastructure. You'll conduct hands-on penetration testing, lead red team engagements, and collaborate with blue team counterparts to validate and improve detection and response capabilities. Your work will directly influence how Stripe builds, ships,

Lead Cyber Threat Intelligence Data Architect — 10 Locations. Apply via Workday.

As Engineering Manager for Threat Detection, you will lead a high-performing team that powers Datadog's detection program. Threat Detection is the organization responsible for keeping Datadog ahead of an evolving threat environment: closing coverage gaps faster, raising the bar on signal quality, and shipping detections that hold up under the scale and complexity of cloud-native infrastructure. Your team will combine direct detection expertise, platform engineering, and applied AI to ship detections at a pace and scale traditional rule-writing alone cannot match. Examples of what your team will work on include detection-authoring agents, the detection platform that powers every rule in production, coverage analysis, alert triage and response automation, and the evaluation infrastructure that holds these systems to a high bar of fidelity. Detection authorship is a shared responsibility across the organization, and your team will contribute both by building the systems that scale our authoring capacity and by writing detections directly when their domain expertise is the right tool. You will partner closely with our Security Incident & Response Team (SIRT), Cyber Threat Intelligence (CTI), AI Engineering teams, and Datadog's broader Security organization. This is a high-impact leadership role: you will grow a team of security and software engineers responsible for building and executing our detection and AI strategy. At Datadog, we place value in our office culture - the relationships and collaboration it builds and the creativity it brings to the table. We operate as a hybrid workplace to ensure our Datadogs can create a work-life harmony that best fits them. What You’ll Do: Lead the strategy, roadmap, and execution of Datadog Security's shift to AI-accelerated detection and response. Drive development of high-fidelity detections as a shared responsibility across the organization, ensuring your team's systems and direct contributions raise the bar on coverage and

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done. We are hiring a Staff Security Engineer, Threat Detection for our Security team. This is a fully remote role open to candidates across the United States. As Snowflake scales globally, we are investing heavily in AI-powered threat detection and response to protect our customers and our environment at cloud scale. This role helps enhance and extend the reach of Snowflake's Threat Detection Program, with AI and automation as core primitives in how we detect, triage, and respond to threats. You will combine deep security expertise with strong engineering skills to build, maintain, and evolve detections and the pipelines that support them, partnering with stakeholders across Security and Engineering to make informed, data-driven decisions grounded in threat models, proactive threat hunts, and exploration of logs and telemetry. AS A STAFF SECURITY ENGINEER, THREAT DETECTION AT SNOWFLAKE, YOU WILL: Develop and deploy detections using modern engineering practices (testing and validation, CI/CD pipelines, detections as code, and a full detection development lifecycle), spanning both rules-based and AI-assisted detections. Mature our threat detection program by analyzing coverage gaps and mitigating risks through detective controls, experimenting with AI/ML approaches where they impr

Secure Every Identity, from AI to Human Identity is the key to unlocking the potential of AI. Okta secures AI by building the trusted, neutral infrastructure that enables organizations to safely embrace this new era. This work requires a relentless drive to solve complex challenges with real-world stakes. We are looking for builders and owners who operate with speed and urgency and execute with excellence. This is an opportunity to do career-defining work. We're all in on this mission. If you are too, let's talk. We are seeking a Principal Product Manager, Okta Identity Threat Detection and Response Products , an individual contributor role, to drive the evolution of Okta’s cutting-edge identity security offerings. This position requires a strong technical foundation, keen product intuition, cybersecurity knowledge, and exceptional collaboration skills to shape the future of our strategic security products. You'll leverage significant cross-functional influence to execute key initiatives in this critical domain. Built upon the robust Okta Identity Cloud, our mission is to ensure Okta provides the most comprehensive, user-friendly, admin-friendly, and secure Identity Security product suite available. This team is responsible for products including Okta Identity Threat Protection with Okta AI , Okta ThreatInsight , and Okta Network Zones , among other vital security functionalities. Our customers depend on these solutions to safeguard their digital assets and ensure secure access for their users. This role is pivotal in ensuring that security is seamlessly integrated into every facet of our products. Success in this role demands a deep understanding of customer security requirements, a strong empathy for both end-user and administrator experiences, and the ability to strategically prioritize amidst competing demands from various Okta teams. Job Duties and Responsibilities: Roadmap and Vision Define the product strategy and roadmap for Okta Identity Security functional

At Asana, security is foundational to our mission of helping humanity thrive by enabling the world's teams to work together effortlessly. The security team protects Asana's employees, users, and customers by proactively addressing threats and fostering a culture of security throughout our product and operations. We’re looking for a detail-oriented, collaborative Security Operations Engineer to join our Security blue team in Warsaw to help solve complex tracking challenges and ultimately scale our security infrastructure. You'll be a foundational member of the security presence in a key engineering hub, partnering directly with IT, infrastructure, and product teams to ensure we have robust detection and response capabilities. This role is based in our Warsaw office with an office-centric hybrid schedule. The standard in-office days are Monday, Tuesday, and Thursday. Most Asanas have the option to work from home on Wednesdays. Working from home on Fridays depends on the type of work you do, and your recruiter can share more about the in-office requirements. We offer a Contract of Employment (UoP) for our employees in Poland. What you’ll achieve: Lead security incident detection, analysis, and response efforts, ensuring timely and effective remediation of security incidents. Utilize and optimize security tools such as Panther for SIEM, CrowdStrike for endpoint detection and response, and other security platforms. Develop, implement, and maintain security playbooks and automation scripts to streamline security operations and reduce manual toil. Monitor security alerts and threat intelligence feeds, proactively identifying and addressing emerging threats. Conduct forensic analysis during security incidents to understand the scope and impact of incidents. Collaborating with engineering teams to integrate security best practices into development processes and provide guidance on secure configurations. Develop and deliver t

Secure Every Identity, from AI to Human Identity is the key to unlocking the potential of AI. Okta secures AI by building the trusted, neutral infrastructure that enables organizations to safely embrace this new era. This work requires a relentless drive to solve complex challenges with real-world stakes. We are looking for builders and owners who operate with speed and urgency and execute with excellence. This is an opportunity to do career-defining work. We're all in on this mission. If you are too, let's talk. The Identity Threat Protection Team Identity Threat Protection (ITP), powered by cutting-edge Okta AI, shatters the mold of traditional login security. We deliver real-time, surgical defense against the most sophisticated and rapidly evolving threats. By deeply integrating with existing security infrastructure, ITP relentlessly analyzes user behavior and system data to proactively hunt down and neutralize risks before they impact our customers. Join an elite team of full-stack engineers, visionary data scientists, and pioneering ML engineers. We are not just redefining cloud authentication—we are engineering the next-gen security platform that continuously evaluates global threats and constructs a comprehensive, dynamic risk . ITP stands as the uncompromising guardian of trust and security, placing decisive risk prioritization at the core of every authentication and authorization decision. Identity Threat Protection with Okta AI The Staff Software Engineer Opportunity Okta is seeking a Staff Software Engineer to be a driving force on the ITP engineering team. This is your chance to dive into the deep end and solve the most critical and complex security challenges facing enterprises today. We seek a candidate who has not just experience, but a proven record of designing, building, launching, and scaling world-class security products —from concept to global deployment. You will be a technical cornerstone of a team that lives and breathes elegant solutions and