Threat Intelligence Engineer

Written by the T&S Network from Anthropic's posting.

Builds the infrastructure behind Anthropic's threat discovery work, integrating external data sources and developing detection systems that generate leads for investigators hunting abusive behavior. Sits on a small Threat Intelligence team that may grow into a multi-person collections function.

What you'd do

• Build automated detection systems that combine disparate signals to identify abusive behavior.
• Take systems from proof-of-concept to production with monitoring, documentation, and maintenance.
• Maintain YARA rule tooling that lets people write, check, and test rules on live data.
• Integrate external threat intelligence platforms through MCP servers to correlate sources during investigations.
• Build pipelines that ingest RSS, CTI news, and partner-shared intelligence, using Claude to extract TTPs and generate hunting queries.
• Create behavioral analytics on DBT frameworks, plus audit logs that can be searched later.
• Refine detection with investigator feedback to cut down on false positives.

What it asks for

• Strong coding in Python and SQL for detection logic, pipelines, and automation.
• Experience with pipeline orchestration tools such as Airflow or DBT.
• Working knowledge of IOCs, YARA rules, and how threat activity gets correlated.
• Hands-on work connecting third-party APIs and building systems that ingest data.
• Can convert what investigators do day to day into engineering requirements.
• Comfort building v0 systems and iterating on user feedback.
• Strong communication skills with non-engineering stakeholders.

Our best summary of the posting, and it can be wrong. The employer's posting is what counts: read it in full on Anthropicnorth_east before you apply. If we got something wrong, report this listing.