Senior Security Engineer, Threat Intelligence

About 1Password

1Password is experiencing unprecedented growth, surpassing $400M in ARR and maintaining its position on the Forbes Cloud 100 for four consecutive years. We are at the forefront of building a secure and productive digital future, pioneering Extended Access Management to enhance employee productivity without compromising security. Trusted by over 180,000 businesses globally, we take a human-centric approach to cybersecurity.

If you are passionate about contributing to the digital safety of millions, thrive in a fast-paced environment, and enjoy solving complex problems, we encourage you to join our team and help shape a safer, simpler digital future.

The Role: Senior Security Engineer, Threat Intelligence

As a Senior Security Engineer specializing in Threat Intelligence on the Detection & Response team, your primary focus will be on understanding adversary behavior, misuse scenarios, and real-world threats. You will translate this intelligence into practical, operational outcomes, ensuring the team is well-informed, prepared, and capable of acting on critical threats. This role directly strengthens our ability to detect, respond to, and validate our defenses.

This is a hands-on position emphasizing tactical intelligence, operational relevance, and robust cross-functional collaboration. You will work closely with Detection Engineering, Incident Response, and other security teams to embed timely and actionable intelligence into daily security operations. This role reports to the Manager of Detection & Response.

What To Expect

• Research, track, and assess the threat landscape by analyzing relevant threat actors, campaigns, and behaviors affecting 1Password’s attack surface, identity systems, brand, third-party ecosystem, and insider risk scenarios.
• Analyze and prioritize information to develop actionable intelligence that informs detection coverage, hunting activities, and response readiness.
• Partner with Detection Engineering to design and validate threat-based detections, including through adversary emulation, simulation, or controlled testing.
• Use automation and scripting to improve how threat intelligence is collected, enriched, distributed, and actioned across Security workflows.
• Curate and deliver threat intelligence reporting for both technical teams and executive stakeholders, helping inform prioritization, investment decisions, and security strategy.
• Build and maintain repeatable threat intelligence processes, workflows, and documentation that scale with the Detection & Response program.
• Participate directly in security operations by triaging alerts, supporting investigations, managing incidents, and contributing to post-incident learning.

Who You Are

• Operationally minded, with a strong instinct for turning intelligence into concrete security outcomes.
• Comfortable working across the full lifecycle of security events, from alert triage to incident coordination and learning.
• Able to think like an adversary while remaining grounded in defensive priorities and business risk.
• A clear, calm communicator who can distill complex threat scenarios for engineers and senior leaders alike.
• Collaborative, curious, and motivated by improving security through learning, validation, and iteration.

What We're Looking For

• 5+ years of experience in technical security engineering roles, with 3+ years focused on threat intelligence.
• Strong understanding of modern attacker TTPs, including cloud-native, SaaS, identity-focused, and insider-adjacent threat patterns.
• Experience developing intelligence requirements, prioritization frameworks, analysis workflows, and emulation scenarios.
• Hands-on experience with scripting or automation (e.g., Python, APIs, SOAR workflows) to improve operational efficiency and cross-team execution.
• Ability to produce concise, high-quality written intelligence, including executive-level summaries that drive prioritization and strategy.
• Familiarity with security telemetry, logs, and investigative workflows used by detection and response teams.
• Willingness to participate in an on-call rotation and support security incidents during high-severity or off-hours events.

Key skills/competency

• Threat Intelligence
• Adversary Emulation
• Detection Engineering
• Incident Response
• Python Scripting
• Security Automation
• Cloud Security
• SaaS Security
• Identity and Access Management
• Executive Reporting