Security Threat Intelligence Analyst
Core
Engineering and operating enterprise cyber threat intelligence platforms, ingestion pipelines, and enrichment logic to support security operations at scale.
Role type
Individual contributor threat intelligence engineer
Builds
Threat intelligence platforms, data ingestion pipelines, and automation hooks for SIEM/SOAR/EDR tooling
Domain
Cybersecurity / Threat Intelligence
Deliverable
production ML models | infrastructure
Required skills
Engineering enterprise threat intelligence platforms, integrating CTI with SIEM/SOAR/EDR, APIs and data transformation, automation logic, threat intelligence concepts and operationalisation, MITRE ATT&CK and threat-led detection models, incident response support, vulnerability management intelligence
Preferred skills
Experience with Google Threat Intelligence, Recorded Future, or similar platforms, GCTI/GCIA/GCED or cloud security certifications
Technologies
SIEM, SOAR, EDR/XDR, Google Threat Intelligence, Recorded Future
Responsibilities
Engineer and maintain threat intelligence platforms and data sources; Design ingestion pipelines for external, internal, and open-source intelligence feeds; Maintain centralised repositories for indicators, threat actor artefacts, and metadata; Integrate threat intelligence into SIEM, SOAR, EDR/XDR, email, identity, and cloud tooling; Build enrichment pipelines linking incidents to threat actors, campaigns, and TTPs; Partner with Automation Engineering to ensure intelligence is automation-first; Provide engineered intelligence support to Incident Response during active incidents; Enable Detection Engineering and Threat Hunting with structured intelligence outputs; Support Vulnerability Management with intelligence on actively exploited vulnerabilities; Build automation hooks between CTI platforms and SOAR workflows; Improve intelligence delivery speed, accuracy, and signal-to-noise ratio; Define and maintain engineering standards for CTI integrations; Monitor feed efficacy and deprecate low-value intelligence sources; Support audits, assurance, and documentation activities related to CTI
Seniority
Individual contributor, hands-on engineering
