Cyware

Threat Intelligence Engineer (REMOTE)

Cyware • $110K — $130K *
US-AnywhereRemote in United States
Information Technology
5 - 7 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • US Citizenship required in accordance with legal guidelines.
  • 5+ years in threat intelligence as an analyst, engineer, or specialist with enterprise-scale experience.
  • Proficient in STIX/TAXII 2.1, with hands-on implementation of mappings in production.
  • Experience with commercial and open-source threat feeds and threat intelligence platforms.
  • Strong Python programming skills for building and debugging core functionalities.
  • Practical AI fluency with real experience using LLMs for technical tasks.
  • In-depth knowledge of the intelligence lifecycle, MITRE ATT&CK framework, and usage of IOCs.

Responsibilities

  • Map feeds to STIX and manage connector portfolio.
  • Design and maintain mappings from various threat intelligence sources into STIX 2.1.
  • Inspect live payloads and vendor dashboards to understand incomplete API documentation.
  • Oversee connector lifecycle from onboarding to schema validation.
  • Collaborate with integration partners on joint threat intelligence use cases.
  • Leverage AI to enhance engineering workflows and mapping processes.
  • Serve as the threat intelligence SME for product design initiatives.

Benefits

  • Exciting and challenging start-up culture.
  • Comprehensive benefits package including time off and retirement plans.
  • Opportunities for professional development to align with career growth.
  • Competitive compensation packages valuing team contributions.
  • Commitment to diversity in workplace culture.
Full Job Description
What You Will Do:
  • Map feeds to STIX and own the connector portfolio
  • Design and maintain mappings from commercial, open-source, and community threat intelligence sources into STIX 2.1 objects, relationships, markings, patterning, and extensions while preserving semantic fidelity.
  • Understand threat intel feed data models when API documentation is incomplete, or missing: inspect live payloads, sample data, and vendor dashboards to establish ground truth
  • Own connector lifecycle and quality-from onboarding new sources to detecting schema drift, validating mappings, and ensuring production reliability
  • Work directly with feed, sandbox, DRP, and enrichment partners on integrations and joint use cases
  • Leverage AI to accelerate engineering workflows
  • Build and improve an AI-assisted mapping workflow: infer schemas from sample payloads, propose candidate field-to-STIX mappings from documentation, and flag schema changes, while maintaining rigorous validation and human oversight
  • Be the threat intelligence SME for Product
  • Write threat intelligence use cases that drive product design, and pressure-test new capabilities against real analyst workflows.
  • Partner with Product to shape intelligence workflows, including PIRs, ATT&CK-aligned investigations, threat modeling, prioritization, collaboration, and intelligence-driven automation
  • Represent Cyware on MITRE and industry alliance committees, and bring what you learn back inside
  • Be the threat intelligence SME for the field
  • Serve as the technical threat intelligence expert for customers, prospects, and partners, translating complex intelligence concepts into practical business value
  • Enable Solution Architects, Sales Engineers, and Customer Success Managers with the threat intelligence knowledge and use cases they need to win and deliver
Who You Are:
  • US Citizenship is a requirement of this position in accordance with 8 U.S.C 1324b(a)(2)(C)
  • 5+ years in threat intelligence as an analyst, engineer, or specialist, with hands-on experience on enterprise-scale security products
  • Deep working knowledge of STIX/TAXII 2.1 objects, relationships, patterning, markings, and how to handle source data that does not fit the standard cleanly. You have implemented STIX mappings in production-not just studied the specification
  • Hands-on experience with commercial and open-source threat feeds and enrichment sources (CrowdStrike, Mandiant, Recorded Future, Flashpoint, Intel 471, MISP, etc.), and with threat intelligence platforms
  • Python: you write real code. API clients, parsers, normalizers, validators. This role builds and debugs; it does not spec and hand off
  • Practical AI fluency. You have used LLMs for real technical work: schema inference, data mapping, documentation parsing, code generation, and you know where they fail
  • Strong command of the intelligence lifecycle, MITRE ATT&CK, and the handling of IOCs, TTPs, and threat actors in conjunction with SOC, incident response, and threat hunting operations
  • Comfortable in a customer-facing, cross-functional seat: you can defend a mapping decision to an engineer and explain the value of intelligence to a CISO
  • Demonstrated ability to work successfully with colleagues across different time zones and geographies

We're a lean team, so your impact will be felt immediately. If this all sounds like a good fit for you, why not join us?
You'll love working at Cyware because
  • We foster an exciting and challenging start-up culture.
  • We're not just employees. We're people. We offer a comprehensive benefits package including time off, paid holidays, retirement plans, insurance coverage and much more.
  • We'll invest in your career. Our company is growing quickly and we will give you the opportunity to do the same. You will have access to a number of professional development opportunities so that you can keep up with the company's evolving needs.
  • We offer competitive compensation packages. We deeply value the talent our team brings to the table and believe that fair and equitable total compensation packages are part of our commitment to everyone who works here.
  • We value diversity of people, culture, and ideas.
How to Apply

Apply right here. You've found the application!

About Cyware

Cyware is a cybersecurity company that provides threat intelligence and cyber fusion solutions to organizations. The company's platform enables organizations to detect, analyze, and respond to cyber threats in real-time. Cyware's solutions are used by organizations in various industries including finance, healthcare, and government. The company was founded in 2016 and is headquartered in Washington, D.C.
Learn more about Cyware
Size
50 employees
Industry
Information Technology
Founded
2016
* Ladders Estimates

Similar Jobs

  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Wilmington, DE 19805 (New Castle County)
    Reposted Today
  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Atlanta, GA 30349 (Fulton County)
    Reposted Today
  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Grand Prairie, TX 75052 (Dallas County)
    Reposted Today
  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Indianapolis, IN 46227 (Marion County)
    Reposted Today
  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Mason, OH 45040 (Warren County)
    Reposted Today
  • Elevance Health
    Gen AI Engineer
    $110K — $130K *
    Elevance Health
    Nashville, TN 37211 (Davidson County)
    Reposted Today
Ad banner background

Get Ready For Your
Next Interview

More Information Technology Jobs

Find similar Threat Intelligence Engineer (REMOTE) jobs:

NationwideRemote