System Engineer
12+ Months Contract
Hybrid Role in Malvern, PA
Video Interview
**Must have Financial Exp.**
Responsibilities
This role sits at the intersection of threat intelligence, security engineering, automation, and software development. You will work closely with Threat Intelligence, Incident Response, Detection Engineering, Threat Hunting, Vulnerability Management, and Security Operations teams to develop scalable solutions that transform intelligence into action while enhancing Client's ability to anticipate, detect, and respond to cyber threats.
Threat Intelligence Automation
- Design, develop, and maintain automation workflows that support intelligence collection, enrichment, analysis, dissemination, and reporting.
- Build integrations between the Threat Intelligence Platform (TIP), SOAR platforms, SIEMs, cloud environments, and security tooling.
- Design and maintain automated workflows for ingestion, enrichment, deduplication, scoring, validation, and dissemination of indicators of compromise (IOCs).
- Integrate commercial, open-source, industry, internal, and government intelligence sources into the TIP and related security platforms.
- Automate delivery of intelligence to security controls, including SIEM, EDR, email security, network security, and detection engineering platforms.
Threat Intelligence Platform Engineering
- Serve as a primary technical owner of the Threat Intelligence Platform, responsible for automation development, data quality, platform integrations, workflow design, and capability maturation.
- Identify opportunities to improve platform performance, scalability, and user experience.
Vulnerability Intelligence Automation
- Develop automation pipelines that collect, normalize, enrich, and correlate vulnerability intelligence from sources including NVD, CISA KEV, vendor advisories, ISACs, security research, and internal telemetry.
- Build workflows that correlate vulnerabilities with threat actor activity, exploit availability, malware campaigns, and enterprise technology exposure.
Security Operations Integration
- Partner with Incident Response, Detection Engineering, Threat Hunting, Vulnerability Management, and Security Operations teams to automate intelligence-driven workflows.
- Develop integrations that improve information sharing, operational collaboration, and workflow efficiency across security teams.
- Translate intelligence requirements and analyst use cases into scalable automation and engineering solutions.
Collections and Data Engineering
- Develop and maintain data ingestion, normalization, transformation, and enrichment processes that support intelligence operations.
- Serve as a technical leader for intelligence collections engineering and data integration initiatives.
Innovation and Continuous Improvement
- Identify opportunities to eliminate manual processes and improve efficiency through automation and orchestration.
- Evaluate and implement emerging technologies, including AI-enabled capabilities, that enhance intelligence collection, enrichment, analysis, and operational effectiveness.
- Establish metrics and reporting to measure automation effectiveness, analyst efficiency gains, intelligence delivery speed, and operational outcomes.
Qualifications
- Minimum of three years of cybersecurity experience with at least one year focused on security engineering, automation, DevSecOps, software development, or related technical disciplines.
- Robust proficiency in Python and experience developing and maintaining automation workflows and APIs.
- Experience integrating systems using REST APIs, webhooks, and modern data exchange methodologies.
- Experience working with structured and unstructured security data, including JSON, XML, CSV, and related formats.
- Experience with threat intelligence concepts, methodologies, and operational workflows
- Experience implementing or supporting Threat Intelligence Platforms (TIPs) and intelligence standards such as STIX, TA
Never miss an opportunity! Create an alert based on the job you applied for.
