> Markdown version of [/jobs/ext/2643032-threat-intelligence-lead](https://www.wearedevelopers.com/jobs/ext/2643032-threat-intelligence-lead). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Threat Intelligence Lead - **Company:** Obsidian Security, Inc. - **Location:** Palo Alto, CA, United States - **Experience:** Expert - **Salary:** $240,000.0 - $280,000.0 - **Contract:** Permanent contract - **Skills:** JIRA, Software as a Service, Cyber Security, Query Languages, Intrusion Detection and Prevention, Python (Programming Language), Microsoft OneNote, Open Source Technology, Salesforce.Com, Security Information and Event Management, Scripting, Okta, Mitre Att&ck, Cyber Threat Analysis, Slack, Cybercrime, Gsuite, Purple Team (Cyber Security) - **Published:** August 24, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=43ba2103065f66f6 ## About the Role * A person who is excited about working at an industry-leading cybersecurity startup operating at the cutting edge of the field, defending against state-of-the-art threats. * At least 6 years of experience in threat intelligence, threat hunting, detection engineering, incident response, or security operations. Level commensurate with experience. * Demonstrated ability to analyze threat data and produce clear, prioritized, actionable assessments for varied audiences. * Hands-on threat hunting experience across cloud, SaaS, and endpoint telemetry, with fluency in MITRE ATT&CK and the intelligence lifecycle. * Working knowledge of the security capabilities and attack surface of modern IT and SaaS systems such as Okta, Google Workspace, Salesforce, Slack, Notion, and Jira. * Experience with SIEM query languages and with scripting for automation and enrichment in a language such as Python. * Familiarity with intelligence sharing standards and tooling (STIX/TAXII, MISP, OpenCTI, or similar). * Be obsessive about security while doing everything possible to support the overall mission. ## Description We're looking for a Threat Intelligence Lead to join our team and build the function that tells Obsidian what threats matter, why, and what we do about them. The ideal candidate for the role will be a highly technical, passionate, team-oriented professional who can turn a noisy flood of external threat reporting into prioritized, actionable intelligence for both our product and our corporate environment - and then go hunt for it in our own telemetry. The ideal person for this role must be mission and values-driven, must have an ownership mentality, and must put the well-being of our customers, our teammates, and our organization at the forefront of how they operate. This person must be able to operate and thrive in a dynamic, high-growth startup environment within a young and growing Security, GRC, and IT team and programs. This is a critical, high-impact role that will serve as a catalyst for growth for any seasoned cybersecurity professional. The role reports to the Head of Security, works within the Trust Team, partners closely with IT, Engineering, Product, GRC, the Threat Research Lab, and cross-functionally as needed. They will have the support and autonomy to mature, deepen, and scale Obsidian's existing threat intelligence and threat hunting capability. Candidates applying for this sensitive and high-impact role should be highly technical team players with real analytical depth and the judgment to separate signal from noise. They should also have the ability to operate across a cloud-native organization with a cybersecurity mission and a modern tech stack. This is a multi-faceted role within a fast-moving startup and will require the successful candidate to possess an ownership mentality, sound judgment, personal responsibility, and initiative. Your Responsibilities Will Include: Threat Intelligence * Collect, correlate, and synthesize threat intelligence from commercial feeds, open source reporting, ISACs, vendor advisories, researcher communities, and dark web sources into a single coherent picture. * Assess the applicability of each emerging threat, campaign, and vulnerability to the Obsidian product and to Obsidian's corporate infrastructure - and say clearly whether it matters to us and why. * Produce timely, decision-grade intelligence products: threat advisories, actor and campaign profiles, and periodic briefings for both technical teams and leadership. * Track threat actors targeting SaaS, cloud, and identity infrastructure, and maintain a living view of the TTPs most relevant to our customers and to us, mapped to MITRE ATT&CK. * Own the intelligence requirements process - define what we need to know, and drive collection against it rather than reacting to whatever crosses the wire. Threat Hunting and Detection * Run structured, hypothesis-driven threat hunts across corporate and product environments based on IOCs, TTPs, and intelligence-derived leads. * Operationalize indicators into detections, and drive the enrichment and lifecycle management of IOCs so they stay useful instead of stale. * Write and tune the detections yourself - convert hunt findings into durable detection logic, playbooks, and response actions, and partner with incident response to operationalize them. * Support incident investigations with attribution context, actor tradecraft, and pivoting off known infrastructure. * Contribute to purple team exercises and validate that our controls actually detect what the intelligence says we should care about. Customer Zero * Be the customer zero of the Obsidian product - use it at full capability to secure our own corporate assets, run hunts inside it, and pressure-test it the way our most demanding customers do. * Identify use-cases to address, provide feedback on in-development features, and reshape workflows in the product. ## Related Videos - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Stack Overflow: Community and AI](https://www.wearedevelopers.com/videos/600-stack-overflow-community-and-ai) - [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray) - [Agentic employees in world's most downloaded FinTech app](https://www.wearedevelopers.com/videos/100123-agentic-employees-in-world-s-most-downloaded-fintech-app) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Leading Through Stagility: Human Capital Trends That Redefine Work](https://www.wearedevelopers.com/videos/1717-leading-through-stagility-human-capital-trends-that-redefine-work) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)