Threat Intelligence Engineer

Going digital requires holistic thinking that puts humans at the center of everything. Entech delivers complete solutions including strategies, technologies, and implementation services to master digital convergence. We integrate our unique outside-in approach to people, processes, and technology to orchestrate digital empowerment to address today's business challenges. Mastering digital convergence at enterprise scale.

Entech is hiring a Threat Intelligence Engineer for a financial services client. This is a hybrid role that involves working onsite in Malvern, Pennsylvania (3 days per week)

Job Description

This role sits at the intersection of threat intelligence, security engineering, automation, and software development. You will work closely with Threat Intelligence, Incident Response, Detection Engineering, Threat Hunting, Vulnerability Management, and Security Operations teams to develop scalable solutions that transform intelligence into action while enhancing client's ability to anticipate, detect, and respond to cyber threats.

• Threat Intelligence Automation
• Design, develop, and maintain automation workflows that support intelligence collection, enrichment, analysis, dissemination, and reporting.
• Build integrations between the Threat Intelligence Platform (TIP), SOAR platforms, SIEMs, cloud environments, and security tooling.
• Design and maintain automated workflows for ingestion, enrichment, deduplication, scoring, validation, and dissemination of indicators of compromise (IOCs).
• Integrate commercial, open-source, industry, internal, and government intelligence sources into the TIP and related security platforms.
• Automate delivery of intelligence to security controls, including SIEM, EDR, email security, network security, and detection engineering platforms.
• Threat Intelligence Platform Engineering
• Serve as a primary technical owner of the Threat Intelligence Platform, responsible for automation development, data quality, platform integrations, workflow design, and capability maturation.
• Identify opportunities to improve platform performance, scalability, and user experience
• Vulnerability Intelligence Automation
• Develop automation pipelines that collect, normalize, enrich, and correlate vulnerability intelligence from sources including NVD, CISA KEV, vendor advisories, ISACs, security research, and internal telemetry.
• Build workflows that correlate vulnerabilities with threat actor activity, exploit availability, malware campaigns, and enterprise technology exposure.
• Security Operations Integration
• Partner with Incident Response, Detection Engineering, Threat Hunting, Vulnerability Management, and Security Operations teams to automate intelligence-driven workflows.
• Develop integrations that improve information sharing, operational collaboration, and workflow efficiency across security teams.
• Translate intelligence requirements and analyst use cases into scalable automation and engineering solutions.
• Collections and Data Engineering
• Develop and maintain data ingestion, normalization, transformation, and enrichment processes that support intelligence operations.
• Serve as a technical leader for intelligence collections engineering and data integration initiatives.
• Innovation and Continuous Improvement
• Identify opportunities to eliminate manual processes and improve efficiency through automation and orchestration.
• Evaluate and implement emerging technologies, including AI-enabled capabilities, that enhance intelligence collection, enrichment, analysis, and operational effectiveness.
• Establish metrics and reporting to measure automation effectiveness, analyst efficiency gains, intelligence delivery speed, and operational outcomes.

Qualification (8+ minimum years required)

• Hands-on experience with ThreatConnect or Any of the following: Anomali, ThreatQ, OpenCTI are also acceptable
• Must have cybersecurity experience with at least one year focused on security engineering, automation, DevSecOps, software development, or related technical disciplines.
• Strong proficiency in Python and experience developing and maintaining automation workflows and APIs.
• Experience integrating systems using REST APIs, webhooks, and modern data exchange methodologies.
• Experience working with structured and unstructured security data, including JSON, XML, CSV, and related formats.
• Experience with threat intelligence concepts, methodologies, and operational workflows
• Experience implementing or supporting Threat Intelligence Platforms (TIPs) and intelligence standards such as STIX, TAXII

Company Benefits (Can includes)

Health, Dental, Vision, 401(k), 20 days of Paid Time Off (PTO)

Preference: W2

Schedule: Hybrid Work

Work Location: Malvern, PA

Additionally

Entech is an equal-opportunity employer.

This is an On-site role work schedule based out of Malvern, PA office three days on week

No Third-party candidates will be accepted, this is strictly a direct employment opportunity with Entech