Cyber Threat Intelligence Engineer IV

What You’ll Do:

• Track threat actors, campaigns, and TTPs relevant to our industry, geography, and technology stack, and translate findings into actionable intelligence products (briefs, actor profiles, trend reports).
• Partner with the SOC to enrich alerts and investigations with threat context, helping analysts triage faster and more accurately during active incidents.
• Work with Detection Engineering to identify coverage gaps against known adversary behavior (e.g., mapped to MITRE ATT&CK) and help prioritize new detections based on real world threat relevance.
• Collaborate with the Red Team to shape threat informed emulation plans, ensuring exercises reflect the tactics of adversaries most likely to target the organization.
• Feed intelligence into Exposure Management to help prioritize vulnerabilities, misconfigurations, and attack surface findings based on active exploitation trends and threat actor intent.
• Monitor open-source intelligence (OSINT), dark web sources, ISACs, and commercial threat feeds; assess relevance and reliability of incoming intelligence.
• Produce and maintain adversary tracking documentation, including TTP matrices, campaign timelines, and indicator repositories.
• Deliver both tactical (IOC/TTP-level) and strategic (executive-level trend and risk) intelligence outputs tailored to different stakeholders.
• Participate in incident response as a threat intelligence liaison, providing attribution context and likely adversary next-steps.
• Contribute to purple team exercises by bridging red team findings with detection and intelligence perspectives.

Current Internal home-based associates please note: Even as a hybrid posted role you are eligible to apply and, if selected, you may retain your home-based status. However future business or regulatory needs may require on-site work and some roles may carry a preference for hybrid presence.