Threat Intelligence Engineer

About the role

We are looking for a Threat Intelligence Engineer to join Anthropic’s Threat Intelligence team. In this foundational engineering role you will build the infrastructure that powers threat discovery, integrate external data sources, and create tooling that scales investigators’ impact.

Key responsibilities

• Build automated detection systems that combine disparate signals to identify abusive behavior.
• Take detection concepts from proof‑of‑concept to production with monitoring, documentation, and maintenance.
• Develop and maintain YARA rule infrastructure, including authoring, validation, and testing tools.
• Create integrations with external threat intelligence platforms (e.g., VirusTotal, Censys, Urlscan) via MCP servers for multi‑source correlation.
• Build data pipelines ingesting RSS feeds, CTI news, and partner sharing, using Claude to extract TTPs and generate hunting queries.
• Develop behavioral analytics using DBT frameworks and searchable audit logging.
• Establish feedback loops with investigators to tune detection systems and reduce false positives.
• Scrape and normalize external data to feed threat detection and enrichment workflows.

Required profile

• Strong coding proficiency in Python and SQL for detection logic, pipelines, and automation.
• Experience with data pipeline orchestration tools such as Airflow or DBT.
• Familiarity with threat intelligence concepts including IOCs, YARA rules, and correlation techniques.
• Proven ability to integrate external APIs and build data ingestion systems.
• Capability to translate investigator needs into technical requirements and iterate on v0 systems.
• Excellent communication skills for collaboration with non‑engineering stakeholders.

Required skills

• Python
• SQL
• Airflow
• DBT
• YARA
• MISP
• STIX/TAXII
• MCP server integrations
• Web scraping at scale
• Behavioral analytics and anomaly detection
• LLM‑driven automation

What we offer

• Competitive compensation and benefits package.
• Optional equity donation matching.
• Generous vacation and parental leave.
• Flexible working hours and hybrid office policy.
• Collaborative office space in San Francisco.