The opportunity
We are looking for a Threat Intelligence Engineer to join our Threat Intelligence team. In this role, you will build the infrastructure that powers our threat discovery capabilities—integrating external data sources, developing detection systems for automated lead generation,…
What you'll do
Build automated detection systems that use disparate signals to identify abusive behavior.
Take systems from idea to proof-of-concept to production-grade with: appropriate monitoring, documentation, and maintenance processes
Develop and maintain YARA rule infrastructure, including tools for writing,: validating, and testing rules against real data
Create integrations with external threat intelligence platforms (e.g.: VirusTotal, Censys, Urlscan) via MCP servers to enable multi-source correlation during investigations
Build data pipelines that ingest intelligence from RSS feeds, CTI news: sources, and partner sharing, using Claude to extract TTPs and generate targeted hunting queries
Develop behavioral analytics capabilities using DBT-based frameworks and: create searchable audit logging infrastructure
What they're looking for
- Establish feedback loops with investigators to tune detection systems and reduce false positives
- Scrape and normalize data from external sources to feed threat detection and enrichment workflows
- Have strong coding proficiency in Python and SQL for building detection logic, data pipelines, and automation
- Have experience with data pipeline orchestration tools (Airflow, DBT, or similar)
