> Markdown version of [/jobs/ext/4629376-security-engineer-threat-intel](https://www.wearedevelopers.com/jobs/ext/4629376-security-engineer-threat-intel). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer - Threat Intel

- **Company:** Anthropic Limited
- **Location:** San Francisco, CA, United States
- **Experience:** Expert
- **Salary:** $320,000.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Software as a Service, Cloud Computing, Cloud Engineering, Cyber Security, Computer Telephony Integration, Programming Tools, Domain Name System (DNS), Intrusion Detection and Prevention, Python (Programming Language), Log Analysis, Open Source Technology, Anti-Phishing, Security Information and Event Management, Snort (Software), Google Cloud, Large Language Models, Malware, Cyber Threat Analysis, Kubernetes, Cybercrime, Machine Learning Operations, Data Pipelines
- **Published:** November 7, 2026
- **Apply:** https://www.juju.com/job/28_25304_5eb7eacf83befe26bd26e187cf566b81

## About the Role

* Have 5+ years of hands-on experience in cyber threat intelligence, threat hunting, or intrusion analysis at an organization facing sophisticated adversaries
 * Have deep, demonstrable knowledge of specific nation-state or advanced criminal threat actors - their tooling, infrastructure patterns, tradecraft, and targeting
 * Are a strong engineer: you write production-quality Python (or similar), have built automation and data pipelines, and don't need to hand requirements to someone else to get tooling built
 * Are comfortable performing malware analysis, infrastructure analysis (passive DNS, certificate pivoting, netflow), and log analysis to develop and validate your own findings
 * Have experience authoring detection logic (YARA, Sigma, Snort/Suricata, or SIEM-native queries) and understand what makes a detection durable vs. brittle
 * Can write clearly and concisely - your intelligence products are read and acted on, not filed away
 * Have an existing network in the threat intelligence community and a track record of productive bidirectional sharing, * Experience defending cloud-native and research-heavy environments (AWS/GCP, Kubernetes, ML infrastructure, developer tooling and supply chain)
 * Prior work operating in a threat intelligence role tracking sophisticated or state-sponsored adversaries, where your analysis directly informed detection, threat hunting, and incident response
 * Experience applying LLMs or other AI tooling to accelerate intelligence collection, enrichment, and analysis
 * Public research, conference talks, or open-source tooling contributions in the CTI space, Minimum education: Bachelor's degree or an equivalent combination of education, training, and/or experience

Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience

Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position

Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices.

## Description

Anthropic sits at the frontier of AI development, which makes us one of the most interesting targets in the world for nation-state and advanced criminal actors. The Threat Intelligence function within our Detection & Response team exists to make sure we see them coming. As a Threat Intelligence Engineer, you'll be a hands-on practitioner responsible for producing the actionable intelligence that drives our detections, hunts, and defensive priorities. You'll track the adversaries most likely to target a frontier AI lab, build the tooling and pipelines that turn raw indicators into operational defenses, and work shoulder-to-shoulder with detection engineers and incident responders to make sure intelligence actually changes outcomes. This is a builder's role on a small, high-leverage team - you'll have broad latitude to shape how threat intelligence is collected, analyzed, and operationalized at Anthropic., * Research, track, and report on threat actors and campaigns targeting AI labs, cloud infrastructure, and the broader technology sector - producing timely, actionable intelligence for Security Engineering stakeholders

 * Build and maintain tooling and automated pipelines to collect, enrich, correlate, and operationalize indicators of compromise into our detection and alerting stack
 * Develop and execute intelligence-driven threat hunts across endpoint, cloud, identity, and SaaS telemetry, and turn findings into durable detections
 * Perform technical analysis of malware, phishing infrastructure, and attacker tooling to extract indicators, TTPs, and attribution signals
 * Partner with Detection Engineering and Incident Response to translate intelligence into detection rules, hunting hypotheses, and incident context in near-real-time
 * Curate and triage inbound intelligence from commercial feeds, open source, government, and trusted peer relationships - prioritizing what matters for Anthropic's threat model
 * Contribute to threat models and risk assessments that inform security architecture and defensive investment across the enterprise
 * Build and maintain external intelligence-sharing relationships with peer companies, ISACs, and government partners