Senior Cyber Threat Intelligence Specialist
NinjaOne
full-time
Posted on:
Location Type: Remote
Location: Remote • California, Colorado, Connecticut, Florida, Illinois, Kansas, Maine, Maryland, Massachusetts, New Jersey, New York, North Carolina, Oregon, Tennessee, Texas, Virginia, Washington • 🇺🇸 United States
Visit company websiteSalary
💰 $140,000 - $210,000 per year
Job Level
Senior
Tech Stack
ETLFlashPythonSQL
About the role
- Operate and improve the CTI pipeline: aggregate, normalize, deduplicate, and score intel from commercial, open-source, ISAC/ISAO, and government feeds.
- Own our TIP/TAXII ecosystem (e.g., MISP/OpenCTI or similar): uptime, schemas, tagging, TLP handling, data lifecycles, and automation jobs.
- Publish flash alerts, weekly intel briefs, and deep-dive actor/TTP reports with clear “so-what” and concrete actions for SOC/DFIR.
- Work side-by-side with SOC/DFIR during active incidents to provide rapid context (infrastructure pivots, likely next moves, IOCs).
Requirements
- Proven experience producing actionable intel (flash notes to deep dives) tied to SOC/DFIR outcomes.
- Strong grasp of MITRE ATT&CK (and ideally D3FEND) for mapping intel to hunts/detections.
- Hands-on with a TIP/TAXII platform (MISP/OpenCTI or similar) and integrating intel into SIEM/EDR/SOAR.
- Comfortable scripting (Python preferred) for ETL, enrichment, and API integrations; basic SQL/log querying.
- Excellent writing and visualization skills—concise “so-what,” clear action items, audience-appropriate tone.
- Pragmatic prioritization, PIRs discipline, and respect for TLP and legal/contractual boundaries.
- Near-fluent (C1+) English with strong cross-functional communication.
Benefits
- medical, dental, and vision insurance
- 401(k) plan
- unlimited PTO
Applicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard skills
scriptingPythonSQLlog queryingETLdata enrichmentAPI integrationsMITRE ATT&CKD3FENDTIP/TAXII
Soft skills
writing skillsvisualization skillspragmatic prioritizationcommunicationaudience-appropriate toneconcisenessaction item claritycross-functional collaborationrespect for legal boundariesPIRs discipline