Threat Intelligence Engineer

Threat Intelligence Engineer on Anthropic's Threat Intelligence team, building the infrastructure investigators use to discover threats. The engineer creates automated detection systems that combine many signals to flag abusive behaviour, develops YARA rule tooling, connects external intelligence platforms such as VirusTotal, Censys and Urlscan through MCP servers, builds pipelines that ingest CTI feeds and use Claude to extract TTPs and generate hunting queries, and adds behavioural analytics and searchable audit logging. Systems go from prototype to production with monitoring and feedback loops that cut false positives.

The team wants strong Python and SQL, pipeline orchestration with Airflow or DBT, familiarity with IOCs, YARA and threat correlation, and experience integrating external APIs. CTI or security operations background and MISP or STIX/TAXII are pluses. Remote-friendly, with travel.