Threat Intelligence Engineer

The Threat Intelligence Engineer supports the research, collection, and analysis of threat data that enables Black Duck to detect and respond to threats targeting the enterprise and its software supply chain. Working within the Threat Intelligence function under moderate supervision, you apply foundational knowledge of adversary tradecraft to assist in producing intelligence products, maintaining indicator pipelines, and contributing threat context to security workflows across the organization. This role solves moderately complex problems within defined guidelines and policies, collaborates with senior engineers on intelligence operations, and supports broader cybersecurity and security operations functions as capacity allows.
Essential Functions/Responsibilities
• Assist with collection, processing, and analysis tasks across the intelligence requirements-to-dissemination workflow.
• Help maintain the intelligence requirements register under guidance from senior team members.
• Draft threat actor profiles, campaign summaries, and indicator packages for technical audiences; refine products based on senior engineer feedback.
• Ingest, validate, and score indicators of compromise (IOCs) from commercial feeds (e.g., Recorded Future), open-source, and internal sources.
• Support integration of IOC pipelines with SIEM and EDR platforms, including Sumo Logic and CrowdStrike Falcon/NG SIEM.
• Apply confidence scoring and structured formats (e.g., STIX 2.1) to intelligence artifacts; escalate data quality issues to senior team members.
• Monitor open-source package registries (npm, PyPI, Go, Maven, and others) and CI/CD pipeline integrity signals for indicators of adversarial activity including typosquatting, dependency confusion, and build-pipeline compromise.
• Contribute to the internal supply chain threat detection program by assisting with data collection, documentation, and detection logic testing.
• Assist broader cybersecurity and security operations functions — including CSIRT, Vulnerability Management, and PSIRT — with alert triage, threat research, and DLP investigation enrichment, as capacity allows.
• Support security investigations by researching threat actor behaviors, identifying relevant IOCs, and providing contextual summaries.
• Prepare threat intelligence summaries and briefing materials for internal consumers including CSIRT and Vulnerability Management.
• Identify opportunities for workflow improvements within own area and recommend changes to senior team members.
• Learn and follow applicable standards for intelligence data handling, sharing agreements, and governance; contribute to supporting documentation as directed.
• Other tasks and activities as assigned.
Required Education/Experience & Skills
• Typically at least two (2) years of experience in threat intelligence, security operations, threat hunting, or a closely related cybersecurity role; demonstrated ability to solve moderately complex problems within established guidelines.
• Working familiarity with the intelligence production lifecycle, threat actor profiling concepts, and structured formats (e.g., STIX 2.1); ability to apply MITRE ATT&CK for basic TTP mapping.
• Practical experience working within enterprise SIEM or EDR environments; ability to run queries, review alerts, and support detection validation (current platforms include Sumo Logic and CrowdStrike Falcon/NG SIEM).
• Conceptual understanding of adversarial techniques targeting open-source ecosystems — including typosquatting, dependency confusion, registry abuse, and build-pipeline compromise — and the ability to identify relevant indicators.
• Strong written and verbal English communication skills; able to explain moderately complex threat information clearly to peers and adjacent teams; comfortable escalating appropriately under moderate supervision.
• Bachelor's degree in computer science, information security, or a related field preferred; entry-level security certified