Role & responsibilities We are looking for a hands-on Threat Intelligence & Detection Engineer to design and build IDrives proprietary threat data feeds and EDR detection rules from scratch.
- Build automated research pipelines (Python/Go scripts, web crawlers, honeypots) to collect threat indicators from OSINT, dark web leak sites and community repositories.
- Design and maintain IDrive’s file hash reputation database (MD5, SHA-1, SHA-256) across Windows, macOS and Linux, including malware family tags, severity scores and clean-file whitelists to reduce false positives.
- Build web and URL reputation pipelines to identify phishing links, malicious delivery domains, wildcard domain patterns and botnet C2 infrastructure.
- Author, test and tune YARA rules, Sigma rules and behavioral detection logic (process anomalies, credential theft, lateral movement, persistence, ransomware execution) for the IDrive client agent.
- Perform static and energetic analysis of suspicious binaries and scripts (Windows, macOS, Linux, PowerShell, VBScript), including deobfuscation, host forensics and traffic analysis, to extract actionable IoCs.
- Package threat data in standard formats (JSON, STIX 2.1) mapped to MITRE ATT&CK;, and own the publishing cadence for cloud lookup APIs and client protection engines.
- Evaluate and select research tools, licenses, cloud instances and reverse-engineering tools needed for your workspace (fully funded by IDrive). Preferred candidate profile
- 5 to 8 years of experience in Cyber Threat Intelligence, Threat Hunting, Malware Analysis, DFIR or Detection Engineering.




- Strong proficiency in Python and SQL (or Go/Bash) to build data parsers, API collection scripts, log-hunting queries and automated feed workflows.
- Deep understanding of attacker TTPs: execution, persistence, privilege escalation, credential theft, lateral movement, C2 and data exfiltration.
- Solid knowledge of file hash indexing, clean-file whitelisting and URL/domain classification pipelines.
- Proven experience writing or tuning production-grade YARA rules, Sigma rules, regex domain masks and behavioral EDR detections.
- Hands-on malware and artifact analysis using tools such as Ghidra, IDA Pro, x64dbg, Wireshark, or sandboxes like Any.
Run/Cuckoo.
- Familiarity with STIX 2.1, TAXII, JSON schemas and the MITRE ATT&CK; matrix.
- Self-starter with a builder mindset, able to work independently and create systems from scratch.
- Strong verbal and written communication skills.
-

Education:
B.
E./B.
Tech/M.
E./M.
Tech in any specialization. Good to have
- Experience deploying honeypots or custom OSINT collection engines.
- Knowledge of AWS/GCP/Azure and database indexing (Elasticsearch, PostgreSQL, ClickHouse) for fast hash/URL lookups.
- Certifications such as GREM, GCTI, CTIA, CySA+ or CEH. Perks and benefits
- Medical insurance for you and your family, life and accidental insurance, and a free annual health check-up.
- Hybrid work model with flexible hours, paid time off and parental leave.
- Startup-style culture with ownership of projects from concept to completion.

📌 Threat Intelligence (Bengaluru)
🏢 IDrive Software India
📍 Bengaluru