Cyber Threat Intelligence Researcher

About Artemis

Artemis is building the future of AI-driven cybersecurity, helping companies defend themselves effectively in an era where AI is fighting AI on the cyber battlefield.

Our platform brings a new approach to the $100B security operations market, building a live model of each customer’s environment and using AI agents to detect, investigate, hunt, and respond to threats at machine speed. Just one year after our founding, Artemis is one of the fastest-growing cybersecurity companies of all time, with customers including multiple Fortune 500 companies, Global 2000 enterprises, and AI innovators like Cursor.

We have raised $70M from Felicis, First Round Capital, Theory Ventures, Two Sigma Ventures, Lockstep VC and Brightmind. We are also backed by some of the most prominent operators in cybersecurity, including the CEO of Crowdstrike, the former CEO and CTO of Splunk, and the founders of Abnormal AI and Demisto.

Artemis’s founders have built and scaled security products used by tens of thousands of customers. Shachar Hirshberg (CEO) led Amazon GuardDuty, the world’s largest cloud detection product, was an early employee at Demisto, the company that invented the SOAR category, was an engineering leader at Palo Alto Networks, and holds an MBA from Harvard. Dan Shiebler (CTO) led all AI and machine learning at Abnormal AI, the pioneer of behavior-based detection, spent five years building analytics using machine learning and vector databases at Twitter, and holds a PhD in machine learning from Oxford.

Our team of software engineers, AI researchers, security engineers, and product designers comes from Google, Meta, AWS, Wiz, CrowdStrike, SentinelOne, Abnormal AI, Perplexity, Bridgewater, Mercor, CERN, and more.

We’re growing fast and looking for builders who want to help us serve our rapidly expanding customer base.

About the Role

We’re looking for a Cyber Threat Intelligence Researcher to lead original threat research and drive Artemis’s managed threat intelligence strategy. You’ll investigate emerging threats, track attacker behavior, publish research, and build threat hunts that help customers discover activity their existing defenses may miss. Your work will connect what’s happening in the threat landscape to what matters in real customer environments.

This is an individual contributor (IC) role focused primarily on hands-on research. You’ll personally develop hypotheses, analyze telemetry, investigate campaigns, write blogs and intelligence reports, and turn discoveries into repeatable hunts. You’ll own research from the initial question through publication and operational use, partnering with detection engineers, offensive security, analysts, and product teams to translate intelligence into better protection.

Responsibilities

• Conduct original threat research – Investigate emerging campaigns, attacker infrastructure, exploitation techniques, and changes in adversary tradecraft across cloud, identity, endpoint, SaaS, AI, and data environments. Combine external reporting with authorized telemetry analysis to develop findings grounded in evidence.

• Drive managed threat intelligence strategy – Own the research roadmap and intelligence priorities for Artemis’s managed offering. Define the threats and questions that matter to customers, evaluate intelligence sources and partners, and establish how intelligence is collected, assessed, delivered, and kept current.

• Publish research and blogs – Write original technical blogs, campaign analyses, threat advisories, and research reports that establish Artemis as a trusted source of security insight. Explain attack behavior, supporting evidence, defensive implications, and practical hunting guidance for technical and executive audiences.

• Build and execute threat hunts – Translate novel threats and research hypotheses into hunts across customer environments. Identify relevant telemetry, develop queries and behavioral correlations, investigate results, and turn successful approaches into reusable hunt templates with clear prerequisites and limitations.

• Track actors and campaigns – Connect infrastructure, tooling, victimology, and observed behaviors across investigations. Maintain useful campaign and activity-cluster assessments, clearly separating observed facts, analytical judgments, confidence levels, and attribution uncertainty.

• Operationalize intelligence – Partner with detection engineers and the SOC to turn research into detections, investigation guidance, enrichment, and response recommendations. Manage the quality and lifecycle of indicators and intelligence content, including provenance, relevance, confidence, and expiration.

• Research threats involving AI – Investigate how attackers use AI and how they target AI applications, agents, tools, and connected data. Develop practical hypotheses and hunts for emerging abuse, distinguishing demonstrated activity from speculation and identifying where additional telemetry is needed.

• Build research automation – Use Python, APIs, and AI-assisted workflows to accelerate collection, enrichment, correlation, and analysis. Verify sources and conclusions independently, preserve evidence, and build repeatable workflows that scale research without sacrificing analytical quality.

• Deliver actionable customer intelligence – Brief customers and internal teams on relevant developments, explain exposure and observed activity, and recommend concrete next steps. Measure impact through useful hunts, coverage improvements, and customer decisions, and use feedback to refine the intelligence program.

Qualifications

• 5+ years of hands-on cybersecurity experience, with substantial work in threat intelligence, threat research, threat hunting, or incident investigation; equivalent demonstrated expertise is welcome.

• A track record of producing original, evidence-backed research and clear technical writing. Published work, anonymized reports, or other substantive research samples can demonstrate this experience.

• Strong understanding of attacker tactics, techniques, and procedures, with depth in at least one relevant area such as cloud and identity attacks, SaaS compromise, cybercrime campaigns, or targeted intrusions.

• Experience developing and executing hypothesis-driven hunts, analyzing security telemetry, and correlating activity across sources using SQL, KQL, SPL, or similar query languages.

• Experience turning intelligence into operational outcomes, including detections, hunt content, incident insights, or customer guidance.

• Practical Python and API skills for research automation, enrichment, and data analysis, with sound judgment when using AI to support research.

• Strong analytical discipline: evaluate source reliability, test alternative explanations, communicate confidence, and avoid overstating attribution or coverage.

• Ability to prioritize research around customer risk, own work through delivery, and explain technical findings clearly to practitioners and leadership.

• Good judgment handling sensitive telemetry, source restrictions, and publication review, including protecting customer identities and confidential information.

Bonus

• Experience building or operating a managed threat intelligence service, defining intelligence requirements, or evaluating commercial and open-source intelligence feeds.

• Research into AI-enabled attacks, agent security, software supply chains, or threats against data platforms.

• Experience with malware analysis, infrastructure tracking, passive DNS, sandboxing, or adversary emulation.

• Familiarity with MITRE ATT&CK and ATLAS, STIX/TAXII, intelligence platforms, or detection-as-code workflows.

• Contributions to public research, conference talks, open-source intelligence tooling, hunt libraries, or detection content.

• Customer-facing experience delivering threat briefings, research findings, or hunting outcomes in an MDR, MSSP, or security product environment.

Why Work at Artemis?

• Make a real-world impact. Turn research into hunts, detections, and intelligence that help real companies identify and defend against emerging threats.

• Shape our research voice. Publish original work and help define how Artemis contributes to the security community.

• Own the intelligence strategy. Build a managed threat intelligence capability informed by customer environments and measurable defensive outcomes.

• Work closely with practitioners. Partner with detection engineers, offensive researchers, analysts, and AI engineers who can put your findings into action.

Compensation

We offer a competitive compensation of $160,000-$200,000 per year, and a top-of-market equity component. A variety of factors are considered when determining the compensation, including a candidate’s professional experience. Final offer amounts may vary from the amounts listed.

Equal Opportunity

At Artemis, we believe the best ideas come from diverse teams. We’re committed to creating an inclusive environment where people of all backgrounds, experiences, and perspectives can do their best work. We welcome everyone, regardless of race, gender, age, religion, identity, or anything else that makes you, you.