Description

You will design and maintain Python-based automation workflows to support threat intelligence operations, acting as the technical owner for the Threat Intelligence Platform.

This role is hybrid.

Responsibilities

• Build integrations between the TIP, SOAR, SIEM, EDR, and cloud platforms to automate IOC collection, enrichment, scoring, and distribution.
• Develop automated pipelines that correlate vulnerability intelligence with exploit activity, threat actors, and internal asset exposure.
• Integrate commercial, open-source, and government threat feeds into the organization's intelligence platform.
• Partner with Incident Response and Detection Engineering teams to translate operational needs into scalable engineering solutions.
• Create metrics and reporting to measure automation effectiveness and analyst efficiency.

Required Skills

• Minimum 4 years of cybersecurity experience, including at least 1 year in Security Engineering, Automation, or DevSecOps.
• Strong Python development skills for building automation solutions and API integrations.
• Experience integrating applications using REST APIs, webhooks, and modern API-based architectures.
• Proficiency with structured and unstructured security data formats (JSON, XML, CSV).
• Hands-on experience developing automation workflows for cybersecurity operations.
• Knowledge of threat intelligence concepts, operational workflows, and intelligence lifecycle.
• Experience with Threat Intelligence Platforms (TIPs) and standards such as STIX and TAXII.
• Experience integrating security technologies such as SIEM, SOAR, EDR, or cloud security platforms.

Preferred Skills

• Experience with vulnerability management automation and data sources like NVD or CISA KEV.
• Familiarity with data engineering, ETL pipelines, or large-scale data ingestion.
• Exposure to AI/ML technologies or generative AI for improving security operations.

Key Skills

Education

Bachelor's degree