Threat ATG & VMDR Expert

Armis, the cyber exposure management & security company, protects the entire attack surface and manages an organization’s cyber risk exposure in real time. In a rapidly evolving, perimeter-less world, Armis ensures that organizations continuously see, protect and manage all critical assets - from the ground to the cloud. Armis secures Fortune 100, 200 and 500 companies as well as national governments, state and local entities to help keep critical infrastructure, economies and society stay safe and secure 24/7.

Armis is a privately held company headquartered in California.

About Armis

Armis is the leading unified asset visibility and cybersecurity intelligence platform — trusted by Fortune 100 enterprises and governments to protect unmanaged, IoT, OT, and IT environments.
Our AI-powered Armis Centrix™ platform delivers real-time asset intelligence to secure the unseen — enabling organizations to understand their entire attack surface and act fast against emerging threats.

The Threat ATG & VMDR Expert will play a critical role in Armis’ global security strategy — uniting threat intelligence, detection engineering, and proactive defense to protect our customers across complex, hybrid ecosystems.

Role Overview

This senior technical role blends Advanced Threat Group (ATG) intelligence with Early Warning Detection & Response (VMDR) capabilities to drive real-time visibility, rapid response, and global threat resilience for Armis customers.
You will design, build, and operationalize detection and response workflows that turn intelligence into action — helping customers anticipate, detect, and neutralize sophisticated adversary behaviors.

Key Responsibilities

• Lead the Threat ATG and VMDR function— integrating threat intelligence, behavioral analytics, and customer telemetry into coordinated response operations. Along with Advocating and demonstrating the Armis ASQ approach to threat management
  Research, analyze, and attribute threat actor activity, tactics, and campaigns into usable and relevant content to Armis’ customer base.
• Develop custom detection logic, playbooks, and hunt queries for Centrix 

• Fuse threat intelligence (IOCs, TTPs, MITRE ATT&CK) with vulnerability, detection, and exposure data to create actionable detection strategies.
  
  
• Automate threat detection and response pipelines using Python, PowerShell, or REST APIs.
  
  
• Drive incident triage, containment, and response coordination for customer environments, in collaboration with regional CS and Security Engineering teams.
  
  
• Maintain a continuous feedback loop between Threat Intel, EWDR, and Product Engineering to improve detection coverage and response accuracy.
  
  
• Publish weekly threat summaries, dashboards , post-incident analyses and other consumable content for Centrix Customers tailored to customer environments.
  
  
• Support red/blue-team and purple-team exercises, validating threat coverage and refining response readiness.
  
  
• Serve as a regional subject-matter expert for emerging attack vectors targeting IoT, OT, and cloud-native environments.
  
  

Required Qualifications

• 7 + years of experience in Threat Intelligence, Detection Engineering, or Incident Response.
  
  
• Deep understanding of Armis and ASQ. MITRE ATT&CK, TIBER, Diamond Model, and adversary emulation frameworks.
  
  
• Hands-on experience with SIEM/SOAR tools such as Splunk ES, Sentinel, Chronicle, Cortex XSOAR, or QRadar.
  
  
• Proven ability to correlate threat, vulnerability, and asset data for contextual risk prioritization.
  
  
• Proficiency in scripting/automation (Python, PowerShell, Bash, REST APIs).
  
  
• Strong knowledge of cloud & container threat detection (AWS GuardDuty, Azure Defender, GCP Security Command Center, Kubernetes audit logging).
  
  
• Experience performing or supporting incident response, malware analysis, and threat hunting.
  
  
• Excellent communication and presentation skills, especially in customer-facing security contexts.
  
  

Preferred Experience

• Prior experience in SaaS or cybersecurity product organizations delivering managed detection or threat intel services.
  
  
• Familiarity with Armis Centrix™ or other asset-intelligence / exposure-management platforms.
  
  
• Certifications: GCTI, GCFA, GREM, GCIA, CISSP, CISM, or OSCP.
  
  
• Experience creating threat models and detection coverage matrices mapped to MITRE ATT&CK.
  
  

Knowledge of AI/ML-driven threat correlation and automation frameworks

Salary range guidance for this position is: $157,000 - $200,000

The salary range listed does not include other forms of compensation or benefits (e.g. i.e. bonuses, commissions, stocks, health insurance benefits, etc.) offered to candidates. Visit our careers site for more information on benefits at Armis

The choices you make in your career journey matter. You want to do interesting work in an important field while also having time to live your life, which is why we place so much value in your life-work balance. Armis sets you up for success with comprehensive health benefits, discretionary time off, paid holidays including monthly me days, and a highly inclusive and diverse workplace. Put your unique experiences and perspective to work in an environment where they will enable you to thrive, grow, and live your life with integrity.

Armis is proud to be an equal opportunity employer. We never discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, age, disability, veteran status, genetic information, marital status or any other legally protected (or not) status. In compliance with federal law, all persons hired will be required to submit satisfactory proof of identity and legal authorization.

Please click here to review our privacy practices.