Security Engineer - Threat Intel

About the role

Anthropic is building safe, interpretable AI and needs a dedicated security professional to protect its frontier AI research. As a Security Engineer focused on Threat Intelligence, you will turn raw adversary data into actionable defenses that keep the organization ahead of nation‑state and sophisticated criminal actors.

Key responsibilities

• Research, track and report on threat actors targeting AI labs, cloud infrastructure and the broader tech sector, delivering timely intelligence to security engineering teams.
• Design, build and maintain tooling and automated pipelines that collect, enrich, correlate and operationalize indicators of compromise for detection and alerting.
• Conduct intelligence‑driven threat hunts across endpoint, cloud, identity and SaaS telemetry, converting findings into durable detection rules.
• Perform technical analysis of malware, phishing infrastructure and attacker tooling to extract indicators, tactics, techniques and procedures (TTPs) and attribution signals.
• Collaborate closely with Detection Engineering and Incident Response to translate intelligence into detection rules, hunting hypotheses and incident context in near‑real time.
• Curate and triage inbound intelligence from commercial feeds, open‑source, government and peer relationships, prioritising what matters for Anthropic’s threat model.
• Contribute to threat models and risk assessments that shape security architecture and defensive investment.
• Maintain external intelligence‑sharing relationships with peer companies, ISACs and government partners.

Required profile

• 5+ years of hands‑on experience in cyber threat intelligence, threat hunting or intrusion analysis against sophisticated adversaries.
• Deep, demonstrable knowledge of specific nation‑state or advanced criminal threat actors, their tooling, infrastructure patterns and targeting methods.
• Strong engineering mindset with the ability to produce production‑quality code and scalable security tooling.

Required skills

• Building and automating data pipelines for indicator enrichment.
• Technical analysis of malware, phishing campaigns and attacker tooling.
• Threat‑intel research and reporting.
• Collaboration with detection engineering and incident response teams.