Threat Intelligence & Detection Engineer (Cloud Security & Data Feeds)

Role & responsibilities

We are looking for a hands-on Threat Intelligence & Detection Engineer to design and build IDrives proprietary threat data feeds and EDR detection rules from scratch.

• Build automated research pipelines (Python/Go scripts, web crawlers, honeypots) to collect threat indicators from OSINT, dark web leak sites and community repositories.
• Design and maintain IDrive’s file hash reputation database (MD5, SHA-1, SHA-256) across Windows, macOS and Linux, including malware family tags, severity scores and clean-file whitelists to reduce false positives.
• Build web and URL reputation pipelines to identify phishing links, malicious delivery domains, wildcard domain patterns and botnet C2 infrastructure.
• Author, test and tune YARA rules, Sigma rules and behavioral detection logic (process anomalies, credential theft, lateral movement, persistence, ransomware execution) for the IDrive client agent.
• Perform static and dynamic analysis of suspicious binaries and scripts (Windows, macOS, Linux, PowerShell, VBScript), including deobfuscation, host forensics and traffic analysis, to extract actionable IoCs.
• Package threat data in standard formats (JSON, STIX 2.1) mapped to MITRE ATT&CK, and own the publishing cadence for cloud lookup APIs and client protection engines.
• Evaluate and select research tools, licenses, cloud instances and reverse-engineering tools needed for your workspace (fully funded by IDrive).

Preferred candidate profile

• 5 to 8 years of experience in Cyber Threat Intelligence, Threat Hunting, Malware Analysis, DFIR or Detection Engineering.
• Strong proficiency in Python and SQL (or Go/Bash) to build data parsers, API collection scripts, log-hunting queries and automated feed workflows.
• Deep understanding of attacker TTPs: execution, persistence, privilege escalation, credential theft, lateral movement, C2 and data exfiltration.
• Solid knowledge of file hash indexing, clean-file whitelisting and URL/domain classification pipelines.
• Proven experience writing or tuning production-grade YARA rules, Sigma rules, regex domain masks and behavioral EDR detections.
• Hands-on malware and artifact analysis using tools such as Ghidra, IDA Pro, x64dbg, Wireshark, or sandboxes like Any.Run/Cuckoo.
• Familiarity with STIX 2.1, TAXII, JSON schemas and the MITRE ATT&CK matrix.
• Self-starter with a builder mindset, able to work independently and create systems from scratch.
• Strong verbal and written communication skills.
• Education: B.E./B.Tech/M.E./M.Tech in any specialization.

Good to have

• Experience deploying honeypots or custom OSINT collection engines.
• Knowledge of AWS/GCP/Azure and database indexing (Elasticsearch, PostgreSQL, ClickHouse) for fast hash/URL lookups.
• Certifications such as GREM, GCTI, CTIA, CySA+ or CEH.

Perks and benefits

• Medical insurance for you and your family, life and accidental insurance, and a free annual health check-up.
• Hybrid work model with flexible hours, paid time off and parental leave.
• Startup-style culture with ownership of projects from concept to completion.