1Password is growing faster than ever. We’ve surpassed $400M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up with iconic partners like Oracle Red Bull Racing and the Utah Mammoth.
About 1Password
At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Extended Access Management, a new cybersecurity category built for the way people and AI agents work today. As one of the most loved brands in cybersecurity, we take a human-centric approach in everything from product strategy to user experience. Over 180,000 businesses, from Fortune 100 leaders to the world’s most innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work.
If you're excited about the opportunity to contribute to the digital safety of millions, to work alongside a team of curious, driven individuals, and to solve hard problems in a fast-paced, dynamic environment, then we want to hear from you. Come join us and help shape a safer, simpler digital future.
At 1Password, security isn’t just a feature – it’s our foundation. The Security Operations team’s mission is to protect the business by securing the systems, tools, and processes that power how we work. Our mission is to keep 1Password productive, resilient, and safe through proactive monitoring, rapid response, and continuous improvement of preventative and detective controls.
The Cyber Threat Intelligence (CTI) function helps drive intelligence-led security. Our goal is not just to track threats, but to turn adversary behavior and emerging techniques into real improvements across detection, response, and adversary simulation.
This is not a traditional, reporting-heavy threat intelligence role.
This role is focused on operationalizing intelligence. You will build automation, integrate intelligence into security tooling, develop intelligence-driven hunting hypotheses, and help ensure threat intelligence directly influences how we detect, respond to, and simulate attacks.
This is a high-impact role that blends adversary research, technical engineering, and cross-functional collaboration.
This role reports to the Manager of Detection & Response.
What You’ll Do
Track and analyze threat actors, campaigns, and techniques targeting identity and cloud environments
Translate intelligence into actionable detections, hunting hypotheses, and adversary simulations
Partner with Detection Engineering, Incident Response, and other security teams to drive security decisions
Produce clear technical assessments and executive-ready insights to inform risk prioritization
Build and maintain automated pipelines to ingest, enrich, and distribute threat intelligence
Map adversary behaviors to internal telemetry and control coverage to identify gaps
Apply AI and intelligent tooling to accelerate analysis and correlation while maintaining rigor
Strengthen intelligence-led security practices through hypothesis-driven hunting and continuous learning
Who You Are
An adversary-focused security engineer who understands attacker behavior and defensive systems.
A builder who enjoys designing automation, integrations, and scaling workflows.
Comfortable writing code, working with APIs, and integrating security platforms.
Analytical and hypothesis-driven, with strong judgment in assessing threat credibility and relevance.
A strong collaborator who can translate intelligence into practical security improvements
Able to clearly communicate complex ideas to technical and non-technical audiences
What You Bring
5+ years of experience in cyber threat intelligence, with 3+ years focused on security engineering and automation.
Strong understanding of modern attacker techniques, particularly in identity, credential abuse, cloud exploitation, and AI-assisted attack scenarios.
Experience integrating threat intelligence platforms and building automation around intelligence ingestion and enrichment.
Proficiency in scripting or programming (e.g., Python, Go) and working with APIs and data pipelines.
Experience applying AI/ML-assisted tools to enhance intelligence analysis or signal prioritization.
Willingness to participate in an on-call rotation and support security incidents during high-severity or off-hours events.
You belong here.
1Password is proud to be an equal opportunity employer. We are committed to fostering an inclusive, diverse and equitable workplace that is built on trust, support and respect. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, colour, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken or veteran status. Be yourself, find your people and share the things you love.
Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email us at [email protected] and we’ll work to meet your needs.
Remote work is a part of our DNA. Given that our company was founded remotely in 2005, we can safely say we're experts at building remote culture. That said, remote work at 1Password does mean working from your home country. If you've got questions or concerns about this, your talent partner would be happy to address them with you.
Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law.
1Password uses artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing and predictive analytics, to assist in the initial screening of employment applications and improve our recruitment process. See here for the latest third party bias audit information. If you prefer not to have your application assessed using AI/ML features, you may opt out by completing this form. For additional information see our Candidate Privacy Notice.