Threat Intelligence Engineer

About the role

The Threat Intelligence Engineer will support Black Duck’s research, collection, and analysis of threat data to protect the enterprise and its software supply chain. Working under moderate supervision within the Threat Intelligence function, you will apply foundational knowledge of adversary tactics to produce intelligence products and enrich security workflows.

Key responsibilities

• Assist in the end‑to‑end intelligence workflow, from requirements gathering to dissemination of threat reports.
• Draft and refine threat actor profiles, campaign summaries, and indicator packages for technical audiences.
• Ingest, validate, and score indicators of compromise from commercial feeds, open‑source, and internal sources.
• Integrate IOC pipelines with SIEM and EDR platforms such as Sumo Logic and CrowdStrike Falcon.
• Apply confidence scoring and format intelligence artifacts using STIX 2.1.
• Monitor open‑source package registries (npm, PyPI, Go, Maven) and CI/CD pipeline signals for supply‑chain attacks.
• Support broader cybersecurity functions, including CSIRT, Vulnerability Management, and PSIRT, with alert triage and threat research.
• Prepare concise threat intelligence summaries and briefing materials for internal stakeholders.

Required profile

• Basic understanding of adversary tradecraft and threat intelligence processes.
• Experience working with security data feeds and indicator management.
• Ability to collaborate with senior engineers and contribute to security operations.
• Strong analytical and written communication skills for technical audiences.

Required skills

• Recorded Future commercial threat feed integration
• Sumo Logic SIEM
• CrowdStrike Falcon/NG SIEM
• STIX 2.1 formatting
• Monitoring npm, PyPI, Go, Maven package registries
• CI/CD pipeline security monitoring
• Indicator of compromise (IOC) handling and scoring