Threat Collections Engineer

Anthropic Anthropic · AI Frontier · Washington, DC · Safeguards (Trust & Safety)

Anthropic is seeking a Threat Collections Engineer to build infrastructure for threat discovery. This role involves integrating external data, developing detection systems, and creating internal tooling. The engineer will take projects from concept to production, work with investigators, and scale the collections function. Responsibilities include building automated detection systems, developing YARA rule infrastructure, creating integrations with threat intelligence platforms, building data pipelines using Claude for TTP extraction, developing behavioral analytics, and scraping/normalizing data.

What you'd actually do

  1. Build automated detection systems that use disparate signals to identify abusive behavior.
  2. Take systems from idea to proof-of-concept to production-grade with appropriate monitoring, documentation, and maintenance processes
  3. Develop and maintain YARA rule infrastructure, including tools for writing, validating, and testing rules against real data
  4. Create integrations with external threat intelligence platforms (e.g. VirusTotal, Censys, Urlscan) via MCP servers to enable multi-source correlation during investigations
  5. Build data pipelines that ingest intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries

Skills

Required

  • Python
  • SQL
  • data pipeline orchestration tools (Airflow, DBT, or similar)
  • threat intelligence concepts
  • IOCs
  • YARA rules
  • threat correlation techniques
  • integrating external APIs
  • building data ingestion systems
  • translating investigator needs into technical requirements
  • building v0 systems
  • iterating based on user feedback
  • communication skills

Nice to have

  • threat intelligence sharing frameworks (e.g. MISP, STIX/TAXII)
  • cyber threat intelligence
  • security operations
  • abuse detection
  • MCP servers or similar tool integrations for AI systems
  • web scraping
  • data extraction at scale
  • behavioral analytics
  • anomaly detection systems
  • LLM capabilities
  • Top Secret Clearance

What the JD emphasized

  • strong coding proficiency in Python and SQL
  • experience with data pipeline orchestration tools (Airflow, DBT, or similar)
  • familiarity with threat intelligence concepts including IOCs, YARA rules, and threat correlation techniques
  • experience integrating external APIs and building data ingestion systems
  • Can translate investigator needs and workflows into technical requirements
  • Are comfortable building v0 systems and iterating based on user feedback
  • Experience with threat intelligence sharing frameworks (e.g. MISP, STIX/TAXII)
  • Background in cyber threat intelligence, security operations, or abuse detection
  • Experience building MCP servers or similar tool integrations for AI systems
  • Familiarity with web scraping and data extraction at scale
  • Experience with behavioral analytics or anomaly detection systems
  • Understanding of LLM capabilities and how to leverage them for automation

Other signals

  • Build automated detection systems that use disparate signals to identify abusive behavior.
  • Take systems from idea to proof-of-concept to production-grade with appropriate monitoring, documentation, and maintenance processes
  • Build data pipelines that ingest intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries