Threat Intelligence Engineer

About the Role

This role focuses on threat intelligence, threat monitoring, and SOC/CTI operations, requiring a keen eye for meaningful signals within real environments.

Key Responsibilities

• Maintain a solid understanding of the Threat Intelligence Lifecycle and structured analytical techniques.
• Apply frameworks such as the Diamond Model, Kill Chain, and MITRE ATT&CK.
• Produce clear, accurate analytical products and communicate them effectively to audiences with varying technical expertise.
• Develop and integrate tools using Python or scripting languages.
• Build API integrations and lightweight workflows.
• Understand and contribute to detection logic and telemetry, including detection rules and hunting leads.
• Utilize at least one Threat Intelligence Platform (e.g., Google Threat Intelligence / VirusTotal, CrowdStrike Intelligence, Recorded Future).
• Integrate LLMs and automation tools into daily monitoring, enrichment, and analytical workflows.
• Deliver clear and effective communication during incidents and time-critical escalations.

Requirements & Tech Stack

• Experience in threat intelligence, threat monitoring, or SOC/CTI operations.
• Proficiency in Python or scripting.
• Experience with API integrations and workflow building.
• Working knowledge of detection logic and telemetry.
• Experience with at least one Threat Intelligence Platform.
• An AI-native working style, integrating LLMs and automation tools.
• Excellent English language skills.

Qualifications

• Background in Incident Response, SOC operations, or digital forensics.
• Hands-on detection engineering experience, ideally authoring rules in Google SecOps or CrowdStrike.
• Prior experience in IT administration (server, network, endpoint).
• SANS FOR578 (Cyber Threat Intelligence) or equivalent certification.
• Familiarity with threat sharing platforms (MISP) and large-scale IOC management.
• Experience with SOAR platforms, N8N, or Power Automate.
• Data and Process visualization proficiency (e.g., Grafana, advanced Excel, PowerPoint).
• Relevant Certifications: GIAC (GCTI, GCIH, GCFA), CISSP, or OSCP.
• Exposure in AI, GenAI, and Agentic AI is preferred.

Who You Are

• A bridge-builder, comfortable with both analytical judgment and engineering tools.
• Vigilant and curious, with a drive to follow signals to their source.
• A builder, proactive in identifying and addressing gaps.
• Autonomous and outcome-driven, executing decisively and reporting after action.
• A communicator, understanding the need for clear communication for defense execution.
• Energized by transformation and opportunity in unfinished environments.
• Process-aware but not process-bound, able to justify decisions while ensuring progress.
• Collaborative across boundaries, working effectively across squads and with detection engineers and incident responders.