Threat Intelligence Engineer

Responsibilities

• Build automated detection systems that use disparate signals to identify abusive behavior.
• Take systems from idea to proof-of-concept to production-grade with appropriate monitoring, documentation, and maintenance processes
• Develop and maintain YARA rule infrastructure, including tools for writing, validating, and testing rules against real data
• Create integrations with external threat intelligence platforms (e.g. VirusTotal, Censys, Urlscan) via MCP servers to enable multi-source correlation during investigations
• Build data pipelines that ingest intelligence from RSS feeds, CTI news sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries
• Develop behavioral analytics capabilities using DBT-based frameworks and create searchable audit logging infrastructure
• Establish feedback loops with investigators to tune detection systems and reduce false positives
• Scrape and normalize data from external sources to feed threat detection and enrichment workflows
• You may be a good fit if you
• Have strong coding proficiency in Python and SQL for building detection logic, data pipelines, and automation

Languages