Threat Intelligence Lead

Obsidian Security is the leading SaaS security platform trusted by global enterprises like Snowflake T-Mobile and Algolia. We protect 200 organizations across North America Europe the Middle East Southeast Asia Australia and New Zealand including many of the worlds largest Fortune 1000 and Global 2000 companies.

Founded in 2017 and backed by top investors like Greylock Obsidian was built to close a critical gap: securing SaaS apps where business happensMicrosoft 365 Salesforce and hundreds more. The company does this by offering a complete SaaS security platform to reduce risk detect and respond to threats and prevent breaches at the source. Obsidian was built by leaders who redefined endpoint and identity security at CrowdStrike Okta Cylance and Carbon Black. Now theyre transforming how SaaS is secured.

With AI driving rapid SaaS growth and complexity agentic AI tools gain privileged access to sensitive data through integrations creating new risks most security tools miss. Obsidian uniquely detects anomalous OAuth token activity and manages integration risks. Major announcements are on the horizon. Recognizing that SaaS security needs to evolve Obsidian enables growing organizations to start with a lightweight prevention-focused browser extension and expand coverage over time.

With global momentum a growing partner ecosystem including SentinelOne Databricks and Google Cloud and a major fundraise ahead Obsidian is scaling rapidly toward long-term growth and IPO readiness.

Were looking for a Threat Intelligence Lead to join our team and build the function that tells Obsidian what threats matter why and what we do about them. The ideal candidate for the role will be a highly technical passionate team-oriented professional who can turn a noisy flood of external threat reporting into prioritized actionable intelligence for both our product and our corporate environment and then go hunt for it in our own telemetry.

The ideal person for this role must be mission and values-driven must have an ownership mentality and must put the well-being of our customers our teammates and our organization at the forefront of how they operate. This person must be able to operate and thrive in a dynamic high-growth startup environment within a young and growing Security GRC and IT team and programs. This is a critical high-impact role that will serve as a catalyst for growth for any seasoned cybersecurity professional.

The role reports to the Head of Security works within the Trust Team partners closely with IT Engineering Product GRC the Threat Research Lab and cross-functionally as needed. They will have the support and autonomy to mature deepen and scale Obsidians existing threat intelligence and threat hunting capability. Candidates applying for this sensitive and high-impact role should be highly technical team players with real analytical depth and the judgment to separate signal from noise. They should also have the ability to operate across a cloud-native organization with a cybersecurity mission and a modern tech stack. This is a multi-faceted role within a fast-moving startup and will require the successful candidate to possess an ownership mentality sound judgment personal responsibility and initiative.

Threat Intelligence

• Collect correlate and synthesize threat intelligence from commercial feeds open source reporting ISACs vendor advisories researcher communities and dark web sources into a single coherent picture.
• Assess the applicability of each emerging threat campaign and vulnerability to the Obsidian product and to Obsidians corporate infrastructure and say clearly whether it matters to us and why.
• Produce timely decision-grade intelligence products: threat advisories actor and campaign profiles and periodic briefings for both technical teams and leadership.
• Track threat actors targeting SaaS cloud and identity infrastructure and maintain a living view of the TTPs most relevant to our customers and to us mapped to MITRE ATT&CK.
• Own the intelligence requirements process define what we need to know and drive collection against it rather than reacting to whatever crosses the wire.

Threat Hunting and Detection

• Run structured hypothesis-driven threat hunts across corporate and product environments based on IOCs TTPs and intelligence-derived leads.
• Operationalize indicators into detections and drive the enrichment and lifecycle management of IOCs so they stay useful instead of stale.
• Write and tune the detections yourself convert hunt findings into durable detection logic playbooks and response actions and partner with incident response to operationalize them.
• Support incident investigations with attribution context actor tradecraft and pivoting off known infrastructure.
• Contribute to purple team exercises and validate that our controls actually detect what the intelligence says we should care about.

Customer Zero

• Be the customer zero of the Obsidian product use it at full capability to secure our own corporate assets run hunts inside it and pressure-test it the way our most demanding customers do.
• Identify use-cases to address provide feedback on in-development features and reshape workflows in the product.

• A person who is excited about working at an industry-leading cybersecurity startup operating at the cutting edge of the field defending against state-of-the-art threats.
• At least 6 years of experience in threat intelligence threat hunting detection engineering incident response or security operations. Level commensurate with experience.
• Demonstrated ability to analyze threat data and produce clear prioritized actionable assessments for varied audiences.
• Hands-on threat hunting experience across cloud SaaS and endpoint telemetry with fluency in MITRE ATT&CK and the intelligence lifecycle.
• Working knowledge of the security capabilities and attack surface of modern IT and SaaS systems such as Okta Google Workspace Salesforce Slack Notion and Jira.
• Experience with SIEM query languages and with scripting for automation and enrichment in a language such as Python.
• Familiarity with intelligence sharing standards and tooling (STIX/TAXII MISP OpenCTI or similar).
• Be obsessive about security while doing everything possible to support the overall mission.

• Be part of a team-first low-ego mission-focused culture.
• Provide opportunities for professional development.
• Provide opportunities to make high-impact contributions to security.
• Provide opportunities to influence the Obsidian product.
• Annual conference attendance budget
• Competitive salary equity and health benefits
• Opportunity to publish research share non-proprietary code and present at conferences
• Reserve your seat on our rocket ship! We are funded by Greylock Partners Google Ventures Menlo Ventures WingVC Norwest Venture Partners Crescent Cove Advisors and are growing fast.

This role is a game-changer and is about securing our company and shaping our product as we provide cutting-edge capabilities to help organizations increase their security.