Threat Intelligence Engineer

Overview

Threat Intelligence Engineer to build infrastructure for threat discovery, automated detections, and investigation tooling.

What you'll do

• Build automated detection systems that use disparate signals to identify abusive behavior.
• Take systems from idea to proof-of-concept to production with monitoring, documentation, and maintenance.
• Develop and maintain YARA rule infrastructure for writing, validating, and testing rules on real data.
• Integrate external threat intelligence platforms via MCP servers for multi-source correlation.
• Create data pipelines ingesting intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate hunting queries.
• Develop behavioral analytics with DBT-based frameworks and implement searchable audit logging.
• Scrape and normalize external data to feed threat detection and enrichment workflows.

What you'll need

• Strong coding proficiency in Python and SQL for detection logic, data pipelines, and automation.
• Experience with data pipeline orchestration tools (Airflow, DBT, or similar).
• Familiarity with threat intelligence concepts including IOCs, YARA rules, and threat correlation techniques.
• Experience integrating external APIs and building data ingestion systems.
• Ability to translate investigator needs and workflows into technical requirements.
• Strong communication skills to work closely with non-engineering stakeholders.

Details

• Hybrid location-based policy: expected to be in an office at least 25% of the time.
• Annual compensation range: $320,000–$405,000 USD.
• Minimum education: Bachelor’s degree or equivalent combination of education, training, and/or experience.
• Security requirement: A Top Secret Clearance.
• Minimum education required field of study: a field relevant to the role as demonstrated through coursework, training, or professional experience.