Threat Intelligence Engineer

Cyware

Threat Intelligence Engineer at Cyware developing STIX mappings and leveraging AI for cybersecurity solutions. Collaborating with product teams and serving as a technical expert in threat intelligence.

Posted 7/30/2026full-timeRemote • 🇺🇸 United StatesMid-LevelSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in threat intelligence, particularly in STIX/TAXII 2.1 mappings and the integration of various threat feeds. Proficient in leveraging AI for data mapping and schema inference while effectively communicating complex intelligence concepts to diverse stakeholders.

Highest-signal resume keywords

STIX/TAXII 2.1 ExpertisePython ProgrammingThreat Intelligence PlatformsAI FluencyIntelligence Lifecycle Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

STIX/TAXII 2.1 ObjectsThreat Feed IntegrationData MappingSchema InferenceAPI DevelopmentThreat Intelligence AnalysisIncident ResponseThreat HuntingIOC HandlingTTP Analysis

Soft Skills

Customer-Facing CommunicationCross-Functional CollaborationAnalytical ThinkingProblem SolvingStakeholder Engagement

Tools & Technologies

CrowdStrikeMandiantRecorded FutureFlashpointIntel 471MISP

Industry Keywords

Threat IntelligenceMITRE ATT&CKSecurity ProductsSchema DriftAnalyst Workflows

Tech Stack

Tools & technologies

Python

About the role

Key responsibilities & impact

Map feeds to STIX and own the connector portfolio
Design and maintain mappings from commercial, open-source, and community threat intelligence sources into STIX 2.1 objects, relationships, markings, patterning, and extensions while preserving semantic fidelity.
Understand threat intel feed data models when API documentation is incomplete, or missing: inspect live payloads, sample data, and vendor dashboards to establish ground truth
Own connector lifecycle and quality—from onboarding new sources to detecting schema drift, validating mappings, and ensuring production reliability
Work directly with feed, sandbox, DRP, and enrichment partners on integrations and joint use cases
Leverage AI to accelerate engineering workflows
Build and improve an AI-assisted mapping workflow: infer schemas from sample payloads, propose candidate field-to-STIX mappings from documentation, and flag schema changes, while maintaining rigorous validation and human oversight
Be the threat intelligence SME for Product
Write threat intelligence use cases that drive product design, and pressure-test new capabilities against real analyst workflows.
Partner with Product to shape intelligence workflows, including PIRs, ATT&CK-aligned investigations, threat modeling, prioritization, collaboration, and intelligence-driven automation
Represent Cyware on MITRE and industry alliance committees, and bring what you learn back inside
Be the threat intelligence SME for the field
Serve as the technical threat intelligence expert for customers, prospects, and partners, translating complex intelligence concepts into practical business value
Enable Solution Architects, Sales Engineers, and Customer Success Managers with the threat intelligence knowledge and use cases they need to win and deliver

Requirements

What you’ll need

US Citizenship is a requirement of this position in accordance with 8 U.S.C 1324b(a)(2)(C)
5+ years in threat intelligence as an analyst, engineer, or specialist, with hands-on experience on enterprise-scale security products
Deep working knowledge of STIX/TAXII 2.1 objects, relationships, patterning, markings, and how to handle source data that does not fit the standard cleanly. You have implemented STIX mappings in production—not just studied the specification
Hands-on experience with commercial and open-source threat feeds and enrichment sources (CrowdStrike, Mandiant, Recorded Future, Flashpoint, Intel 471, MISP, etc.), and with threat intelligence platforms
Python: you write real code. API clients, parsers, normalizers, validators. This role builds and debugs; it does not spec and hand off
Practical AI fluency. You have used LLMs for real technical work: schema inference, data mapping, documentation parsing, code generation, and you know where they fail
Strong command of the intelligence lifecycle, MITRE ATT&CK, and the handling of IOCs, TTPs, and threat actors in conjunction with SOC, incident response, and threat hunting operations
Comfortable in a customer-facing, cross-functional seat: you can defend a mapping decision to an engineer and explain the value of intelligence to a CISO
Demonstrated ability to work successfully with colleagues across different time zones and geographies.

Benefits

Comp & perks

We foster an exciting and challenging start-up culture.
We’re not just employees. We’re people.
We offer a comprehensive benefits package including time off, paid holidays, retirement plans, insurance coverage and much more.
We’ll invest in your career. Our company is growing quickly and we will give you the opportunity to do the same. You will have access to a number of professional development opportunities so that you can keep up with the company’s evolving needs.
We offer competitive compensation packages. We deeply value the talent our team brings to the table and believe that fair and equitable total compensation packages are part of our commitment to everyone who works here.
We value diversity of people, culture, and ideas.